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EXECUTIVE SUMMARY 


With the introduction of the GDPR, the concept of the one-stop shop was established as one of the 
main innovations. In cross-border processing cases, the supervisory authority in the Member State of 
the controller's or processor's main establishment is the authority leading the enforcement of the 
GDPR for the respective cross-border processing activities, in cooperation with all the authorities which 
may face the effects of the processing activities at stake: be it through the establishments of the 
controller or processor on their territory or through complaints from their residents against these 
processing activities. Indeed, data subjects should be able to easily pursue their data protection rights 
and should be able to complain to a supervisory authority at their place of habitual residence. This 
supervisory authority also remains the contact point for the complainant in the further course of the 
complaint-handling process. In order to meet all these requirements, Article 60 GDPR regulates the 
cooperation procedure between the lead supervisory authority and the other supervisory authorities 
concerned. 


These guidelines handle the interactions of the supervisory authorities with each other, with the EDPB 
and with third parties under Article 60 GDPR. The aim is to analyse the cooperation procedure and to 
give guidance on the concrete application of the provisions. 


General considerations 


A common understanding of the terms and basic concepts is a prerequisite for the cooperation 
procedure to run as smoothly as possible. 


Firstly, the guideline states that: 


- the cooperation procedure applies in principle to all cross-border processing cases, 

- the lead supervisory authority is primarily responsible for handling such cases, without being 
empowered to ultimately decide on its own, and that 

- the cooperation procedure does not impact the independence of the supervisory authorities, 
which retain their own discretionary powers within the framework of cooperation. 


It is recalled that the effects of national procedural regulations must not lead to limiting or hampering 
the cooperation under the GDPR. 


Structure and Content of the guidelines 


These guidelines are based on the requirements of Article 60 and clarify paragraph by paragraph the 
conditions arising from the regulation itself and its practical implementation. 


In the context of Article 60(1) GDPR, it is established that the principles to be observed throughout the 
whole cooperation procedure are mutual obligations. It is stressed that while the achievement of 
consensus among the SAs is not an obligation, the endeavour to reach an agreed consensual decision 
is an overarching objective to be achieved through a mutual and consistent exchange of all relevant 
information. This exchange of information is obligatory for all CSAs, including the LSA. The meaning of 
"relevant" in this context is further clarified through examples. In terms of timeliness, the paper 
recommends sharing the relevant information proactively and as quickly as possible. Lastly, the 
possibility to use informal means of communication to reach consensus is recalled. 


The following section on Article 60(2) GDPR addresses the situation of the LSA requesting CSA(s) to 
provide mutual assistance pursuant to Article 61 GDPR and conducting joint operations pursuant to 
Article 62 GDPR and provides guidance on the specifications of these instruments in the context of an 
ongoing cooperation procedure. 
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The paper addresses the process of the submission of the draft decision under Article 60(3) GDPR. It 
highlights that the LSA has to act proactively and as quickly as possible and that the CSAs should be 
able to contribute to the overall procedure, also before the creation of the draft decision (e.g. 
exchange of information). In addition, the LSA is required to submit a draft decision to the CSAs in all 
cases of cross border processing. 


The sections on Article 60(4)-(6) GDPR outline the different scenarios that follow the submission of a 
draft decision by the lead supervisory authority and thus provide a consistent approach to the 
procedure between the submission of a (revised) draft decision and either the triggering of the binding 
effect in the absence of relevant and reasoned objections or the submission to the dispute resolution 
procedure. The guidelines also recognise the possibility for the LSA to adapt and resubmit the draft 
decision submitted under Article 60(4) GDPR prior to the expiry of the four-week period, provided that 
new factors or considerations justify such adaptation and that their importance is fairly balanced 
against the expediency of the cooperation procedure. In addition, it is specified that there may be 
multiple revised decisions but only in cases where it is likely to reach a consensus due to substantive 
convergence between the LSA and other CSA(s). 


This is followed by the analysis of the different scenarios after the (revised) draft decision has become 
binding on the lead supervisory authority and the supervisory authorities concerned. It is clarified 
which supervisory authority has to adopt the final national decision pursuant to Article 60(7)-(9) GDPR 
on the basis of the draft decision that has become binding and which supervisory authority has to 
notify the controller/processor or the complainant. In this context, the distinction between notifying 
and informing is also addressed. 


Furthermore, the guidelines address the important distinction between situations that constitute a 
dismissal/rejection of a complaint, with the consequence that the complaint-receiving SA adopts the 
final decision, and situations in which the lead supervisory authority acts on the complaint in relation 
to the controller, with the consequence that the lead supervisory authority adopts the final decision. 
In this context, it is highlighted that terms of EU law not making express reference to member state 
law must normally be given an autonomous and uniform interpretation. 


The following section outlines the duties of the controller or processor to ensure that processing 
activities in all its establishments are in compliance with the final decision (Article 60(10) GDPR). 


The last section addresses the specific requirements of the application of Article 66 GDPR (Urgency 
Procedure) in the course of an ongoing cooperation procedure (Article 60 (11) GDPR). 


A quick reference guide annexed to the guidelines is intended to give practitioners in the supervisory 
authorities a quick overview of the procedure and to illustrate the complex procedure. 
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The European Data Protection Board 


Having regard to Article 70(1)(e) of the Regulation 2016/679/EU of the European Parliament and of 
the Council of 27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 95/46/EC, (hereinafter 
“GDPR”), 


Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended 
by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018t, 


Having regard to Article 12 and Article 22 of its Rules of Procedure; 


HAS ADOPTED THE FOLLOWING GUIDELINES 


1 INTRODUCTION 


The number of national enforcement proceedings concerning cross-border data processing activities 
is constantly increasing, with many being resolved within the GDPR cooperation mechanism. While 
Article 57(1)(g), (f) set the frame for the general cooperation, the One Stop Shop (OSS) is established 
under Article 56 and 60 GDPR?. This specific procedure requires the Lead Supervisory Authority (LSA) 
to cooperate with the other Concerned Supervisory Authorities (other CSAs) in an endeavour to reach 
consensus. 


It should be underlined that the OSS model, allowing the supervisory authorities (SAs) of all Member 
States (MS) to be involved in a type of co-decision procedure, is a novel concept to data protection 
legislation introduced by the GDPR. 


These guidelines handle the interactions of the SAs with each other, with the EDPB and with third 
parties under Article 60. The aim is to analyse and give guidance on the concrete application of the 
provisions. As the cooperation procedure relates to processing activities, its outcome concerns, by 
definition, the actors involved in such processing (data subject, controller, processor(s), etc.). However, 
since the duty to cooperate contained in Article 60 applies to SAs, this paper focuses on the obligations 
of the LSA and other CSA(s). 


It is, not in the scope of these guidelines to address the issue of designation of the LSA and other CSAs. 
These guidelines presume that this has been clarified and agreed according to Article 56 as the Article 
60 procedure attributes specific competences and actions to the involved SAs based on their roles. 
Therefore, it is assumed that sufficient information to establish the different roles has been already 
shared at the point that the work under Article 60 GDPR starts. 


t References to “Member States” made throughout these Guidelines should be understood as references to 
“EEA Member States”. 
2 The term “Article” without further specification refers to those of the GDPR. 
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However, in specific situations there might occur later on a shift in the competences and roles of the 
SAs (e.g. anew location of the main establishment or a case of joint controllership). Therefore, as soon 
as the SAs get knowledge of any circumstance that might affect the competence for handling the case 
during the cooperation phase, information should be shared immediately among SAs, in order to 
identify the new presumed LSA and to reach an agreement on the allocation of roles?. 


Upon agreement, the Article 60 procedure would proceed accordingly. If consensus cannot be 
achieved, the matter is to be referred to the EDPB making use of Article 65(1)(b). 


Whenever in these Guidelines reference is made to the use of the "EDPB Information System", such 
reference means the Internal Market Information System ("IMI") in pursuant to Regulation (No) 
1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative 
cooperation using the Internal Market Information System and repealing Commission Decision 
2008/49/EC ("IMI Regulation") ^. The EDPB Information System shall be used in accordance with Article 
60(12) for the supply of all information required under Article 60. In addition, SAs should use all forms 
of communication, such as e-mails, phone, videoconference or in person, to facilitate the process of 
achieving consensus. 


2 ARTICLE 60 IN THE FRAMEWORK OF THE OSS-SYSTEM 


2.1 Applicability of the cooperation procedure 

The cooperation procedure between the LSA and the other CSAs under Article 56(1) and Article 60 
essentially has the following conditions: the processing operation has to be cross-border according to 
Article 4(23), which also means that the controller or processor must have a main or single 
establishment in the EU. Article 4(23) provides for two alternative connected definitions. Firstly, Article 
4(23)(a) requires that the controller or processor has establishments in more than one MS. Secondly, 
the specific data processing operation in question has to be carried out in the context of the activities 
of several EU establishments. According to Article 4(23)(b) the effects on data subjects can define 
cross-border processing. In case the processing takes place in the context of the activities of a single 
establishment of a controller or processor within the EU, cross-border processing is assumed if the 
processing substantially affects or is likely to substantially affect data subjects in more than one MS.° 


The EDPB stresses that Articles 56 and 60° apply to the cooperation between SAs in all cases based on 
cross-border processing, without regard to the origin of the case (complaint, ex officio inquiry, etc.). 
This is without prejudice to the provisions of Article 55’ and Article 65. 


While only Article 60(7) last sentence as well as paragraphs 8 and 9 refer to the handling of complaints, 
Article 56(1) and Article 60 as the core provisions concerning the cooperation procedure refer to cross- 
border processing in general. With regard to the cooperation mechanism, Article 60(3) also refers to 
the fact that the LSA shall “communicate the relevant information on the matter’, i.e. the case in 


3 See also: Opinion 8/2019 on the competence of a supervisory authority in case of a change in circumstances 
relating to the main or single establishment 

4 See Also Article 17 of the Rules of Procedure of the EDPB. 

5 See also: WP244 Guidelines for identifying a controller or processor’s lead supervisory authority. 

€ Except in the case described in para. 13 below. 

7 See also: Recital 128. 
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general, so that it is not at all limited to complaint-based cases. The term “matter” includes for instance 
"ex officio" proceedings and the possibility under Article 57(1)(h) to conduct an investigation e.g. on 
the basis of information from another SA or other public authority. As complaint handling is already 
covered by Article 57(1)(f), this information provided according to Article 57(1)(h) does not have to be 
based on a complaint. 


Furthermore, this is supported by a systematic approach with regard to possible sanctions or remedies 
under Article 58(2), which applies to all types of processing and not just to complaints. 








Example 1: Sources originating from the media or from whistle-blowers provided by a CSA may also 
initiate an Article 60 procedure if they are specific and substantial, i.e. facts are presented in a concrete 
and complete manner. However, simply forwarding a newspaper article without more detailed 
information, e.g. an initial evaluation by the CSA, does not regularly constitute sufficient evidence of a 
data protection breach and would therefore not be considered to be sufficiently substantiated to cause 
supervisory measures. On the contrary, firm evidence does not need to be provided to open an Article 
60 procedure, because the procedure itself aims to establish whether an infringement exists or not. 
However, the LSA has wide discretionary powers to decide when to initiate an investigation ex officio 
based on information received on potential infringements from other CSAs or sources. 





The application in all cross-border cases also follows from the purpose of the cooperation mechanism: 
It was created “to foster a uniform application of the data protection rules through a consistent 
interpretation”? and to ensure effective supervision and enforcement within the Union. A limitation to 
complaint-based cases would contradict this purpose. 


For cases with only local impacts, Article 56(2) and 56(3) provide that the SA, which received the 
complaint or was made aware of a possible infringement, shall be competent if the LSA decides not to 
handle the case. Article 60 does not apply in these cases. Only where the LSA decides to handle the 
case Article 60 is applicable according to Article 56(4). 


2.2 LSA/CSA as involved actors 

Article 56(1) contains a legal definition of the competent LSA; that definition is to be read in 
conjunction with Article 60, which sets out the essential tasks and powers of the LSA in the Article 60 
procedure’. The LSA is defined as the SA of the main establishment or of the single establishment of 
the controller or processor in the Union, which is competent for the cross-border processing carried 
out by that controller, or processor. It is also the sole interlocutor for that controller or processor 
according to Article 56(6). 


The relevant starting point for determining the LSA is the specific cross-border processing of data 
(“carried out”) by the respective controller or the processor”. 


WP244 clarifies that “a lead supervisory authority is the authority with the primary responsibility for 
dealing with a cross-border data processing activity”. In other words, the LSA has the competence for 
the cross-border processing carried out by the given controller or processor, being the sole interlocutor 


8 COM (2020)264 final, p.6. 

° For “local cases” under Article 56(2), the provisions of Article 56(3) and (4) must be observed. 

10 For further information on this matter see also: WP244 rev.01: “Guidelines for identifying a controller or 
processor’s lead supervisory authority” 
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for that controller or processor in the respective MS under Article 56(6). Within the framework of the 
cooperation procedure set out in Article 60, and pursuant to Article 56(1), this competence translates 
into a ‘leading function’, i.e. into a steering role in taking the case forward, organising the cooperation 
procedure with a view to involving the other CSAs, coordinating investigations, gathering evidence etc. 
as well as in the responsibility for submitting a draft decision which is subject to opinions or objections 
by the other CSAs". 


However, the EDPB considers the LSA not to have exclusive competences with regard to the 
cooperation process, i.e. the GDPR provides for a shared responsibility to monitor and enforce the 
application of the GDPR in a consistent manner, so that the LSA's position is subject to the views of the 
other CSAs and the outcome should be a consensually reached decision. This is made clear by the 
decision of the Union legislator that in cases of persistent disagreements between SAs, these must be 
resolved by the EDPB pursuant to Article 65(1)(a). 


According to Article 4(22) a CSA means a SA which is concerned by the processing of personal data 
because: 


(a) the controller or processor is established on the territory of the MS of that SA”; 

(b) data subjects residing in the MS of that SA are substantially affected or likely to be 
substantially affected by the processing; or 

(c) acomplaint has been lodged with that SA. 


The EDPB considers these requirements to be basically obvious and simple to state so that, in principle, 
no special requirements need to be observed here. In terms of factor (a), the existence of an 
establishment will generally be easy to determine. The same applies to (c) and the question whether 
a particular SA has received a complaint. It is to be noted that in (b) the data subject must merely 
reside in the MS in question; he or she does not have to be a citizen of that state”. 


In the event of doubt, it seems appropriate with regard to the legal consequences that basically each 
authority needs to substantiate its reasoning for being concerned. 


The term "substantially affected" has been further defined in WP244 by naming factors (such as use 
of a particular language, use of a particular currency, availability of a service in the MS concerned, 
concrete address through controller or processor etc.) which shall be taken into consideration by each 
authority when assessing whether they are concerned. 


When at any point a previously non-concerned SA becomes concerned during an ongoing Article 60 
procedure (for instance by receiving a complaint), the following basic procedure can be envisaged: 


e The CSA should immediately notify the LSA of its status and request its inclusion into the OSS 
procedure. 


11 In this respect the role of the LSA has been characterised as at several points “primus inter pares”, e.g. by the 
Advocate General in his Opinion on Case 645/19, para. 111. 

12 For further information in the context of the term “establishment” see EDPB Guidelines 3/2018, p.5-7 as well 
as regarding the term of “in the context of the activities of an establishment” 3/2018 p.7-9. 

13 See also: WP244 Guidelines for identifying a controller or processor’s lead supervisory authority, p.9. 
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e The LSA should make sure to involve this new CSA as such, especially in the respective case 
register, and should inform the new CSA of its inclusion into the decision-making procedure. If 
the LSA becomes aware that a not yet involved authority is or has become a CSA, it should 
inform it about this change of status”. 

The involvement of a newly concerned SA in an ongoing cooperation procedure should be possible at 
any stage of the case but cannot have any effect on the procedure enshrined in Article 60. As a result, 
all deadlines and procedures prescribed by Article 60 remain unaffected, i.e. for instance the deadline 
of Article 60(4), once the LSA has submitted its draft decision, applies irrespective of the fact that in 
the meantime a new CSA could join the procedure. 


For this reason, the CSA may consider whether its respective case can still be handled effectively within 
the ongoing cooperation procedure and whether it should rather open a new procedure, for instance 
because the current one does not cover (some) core issues in the case before the CSA. 


2.3 Independence of SAs within the cooperation procedure 
Within the cooperation procedure, both the LSA and the other CSAs act as independent SAs according 
to Article 52(1). 


However, the CJEU stressed’ that the independence of the SAs was introduced in order to give greater 
protection to the data subjects concerned and not to confer a special status on the supervisory bodies 
themselves’. Independence is therefore to be understood as absolute protection against any external 
influence. However, in this context, the SAs form a unit within the framework of a European 
administrative network, within which they are responsible for ensuring the consistent application of 
the GDPR throughout the Union. 


The reference to the cooperation procedure in the provision establishing the SAs (Article 51(2)) 
underlines the importance of the cooperation mechanism for the functioning of a unified supervision 
and an effective protective standard through a consistent application of the GDPR within the Union. 


In this respect, the EDPB underlines that all steps within the cooperation procedure are compatible 
with the legally prescribed independence granted to SAs pursuant to primary law and Article 52, as 
such independence is from external influence as clarified above and has no bearing on the general 
obligation to cooperate that is set out as an overarching duty within Article 60. 


It should be noted that SAs, as national administrative authorities, enjoy a certain margin of discretion 
pursuant to domestic law in deciding with all due diligence the course of action that can best achieve 
the public interest they serve (see Article 51(1)). This discretionary power must be exercised in line 
with the provisions of the GDPR and in accordance with appropriate procedural safeguards set out in 
Union and Member State Law, impartially, fairly and within a reasonable time. 


Thus, the discretion to be acknowledged to SAs acting as independent administrative authorities, free 
from the influence of external stakeholders, cannot be unlimited in particular vis-a-vis EU law, as they 


14 The whole process should be conducted by using the EDPB information system. 

15 CJEU Case C-518/07, Commission v Germany, para. 25 and 32 et seq. [ECLI:EU:C:2010:125], Case C-362/14, 
Schrems v DPC, paras. 99 [ECLI:EU:C:2015:650]; confirmed in Case — C-311/18, Schrems II para. 115 
{ECLI:EU:C:2020:559]. 

16 Case C-518/07, para. 25 [ECLI:EU:C:2010:125], see also Case C-362/14, para. 41. 
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(both the LSA and the other CSAs) are required to act cooperatively and are accountable for their 
decisions (or non-decisions) regarding a given case. 


2.4 Impact of national procedural rules 
Since the GDPR does not regulate all details of cooperation, the tasks and powers entrusted to SAs by 
Article 57 and Article 58 have to be fulfilled by relying on national procedural law. 


It is usual that EU legal instruments may include procedural provisions (such as the GDPR Articles 
conferring certain powers on SAs), but insofar as EU law does not provide for specific procedural rules, 
national procedural law applies. In these cases the principle of national procedural autonomy, which 
is a general principle of EU law, generally applies. This general principle is limited, as is outlined 
extensively in the case law of the CJEU, by the EU principles of equivalence and effectiveness?’”. These 
principles stipulate that the applicable national rules must not treat an EU determined matter more 
unfavorably than purely national ones (equivalence). In addition, the application of national provisions 
must not significantly complicate or make it practically impossible to realise the purpose of the 
European legal standards (effectiveness). 


However, since such different national administrative rules exist, their application may lead to 
differences and may (partly) be the reason why SAs handle cases in different ways and investigate 
them differently. Nevertheless, these distinctions in national (procedural) law must not lead to 
situations in which the principles of equivalence and effectiveness are undermined. 


Accordingly, if it is not possible to reconcile EU law and national requirements in this way, i.e. if the 
national provision contradicts EU law, the national regulations that contradict EU law must in principle 
remain unapplied?®. 


Regarding the cooperation mechanism the EDPB stresses therefore that national (procedural) law 
having impact to the effect of ‘significantly complicating or making it practically impossible to realise’ 
effective cooperation is not compatible with the GDPR and ‘must be reconciled with the requirement 
of uniform application of Community law so as to avoid unequal treatment' (ECJ, C-290/91, para. 8). 
This being an obligation imposed on all Member States, if the above reconciliation proves impossible, 
the consequence is that an authority should consider not applying such national law. 


3 ARTICLE 60(1) - MUTUAL OBLIGATION 


3.1 General 

Article 60(1) provides for a general duty of cooperation, which obliges all involved SAs equally. The 
wording clarifies by the use of “shall” that the obligation to cooperate is not a matter of discretion but 
a legal obligation. 


Article 60(1) lays down basic and overarching principles, which apply throughout the entire 
cooperation between SAs. In accordance with the wording of this Article, the key concepts of the 


17 Regarding the OSS see: Case 645/19 para. 53: ‘The application of the ‘one-stop shop’ mechanism consequently 
requires, as confirmed in recital 13 of Regulation 2016/679, sincere and effective cooperation between the lead 
supervisory authority and the other supervisory authorities concerned.’ 

18 See also: CJEU: Case C-205-215/83, para. 19; C-94/87, para. 12; C-280/13, para. 37. 
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cooperation procedure consist of “an endeavour to reach consensus” and the obligation to “exchange 
all relevant information”. 


The EDPB expressly points out that these obligations are to be complied with by the LSA and every 
other CSA (mutual obligation). 

3.2 The endeavour to reach consensus 

The “endeavour to reach consensus” is to be understood as a legal objectivet?, which does not lead to 
a legal obligation to reach consensus in a respective case. However, this legal objective has a decisive 
influence on all actions of all CSAs throughout the entire cooperation process, i.e. it sets the direction 
for cooperative acting in such a way that SAs do their utmost and make a “serious determined effort’”° 
in order to achieve consensus. 


The cooperation procedure conducted in an “endeavour to reach consensus” necessarily entails a 
mutual exchange of views and documents on the subject matter. This mutual exchange is intended to 
ensure that all circumstances relevant to the case have been taken into account and could thus also 
contribute to prevent disputes??. 


That consensual acting should be the rule is further illustrated by the provisions contained in Article 
60(11) and Article 66(1) whereby “in exceptional circumstances” and “by derogation to (...) the 
procedure referred to in Article 60”, respectively, a CSA may take urgent measures”. 


The importance of this objective is confirmed by the comparison between the current text and the 
original 2012 Commission proposal for the GDPR, which did not mention “consensus” and envisaged 
simply the exclusive competence of the LSA in cross-border cases. The current text mirrors a different 
approach endorsed by the EU legislator, where emphasis is placed on the mandatory cooperation of 
the SAs, which is supposed to be fair and constructive’. In their efforts to reach consensus, SAs should 
use all possible tools, including mutual exchanges of relevant information, providing each other with 
an opportunity to express their views on exchanged information and take into account the point of 
view of other CSAs”. 


As a result, this translates into a mutual obligation placed on the LSA and other CSAs to select 
cooperation approaches that are best suited to achieve consensus as described. 


3.3 The obligation to exchange all relevant information 

A key as well as further priority element of the cooperation procedure lies in the mandatory (“shall”) 
exchange of “all relevant information” between the involved SAs — this applies throughout the whole 
cooperation procedure. 


19 See also: Case C-645/19 para. 51 “..the lead supervisory authority is, in particular, required to endeavour to 
reach consensus. ‘ 

20 Merriam-Webster: “endeavour”. 

21 See also: Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679, para. 9. 

22 See also: Recital 138 stating that “in other cases of cross-border relevance, the cooperation mechanism 
between the lead supervisory authority and supervisory authorities concerned should be applied (...) without 
triggering the consistency mechanism”. 

23 See also: Opinion of AG on Case C-645/19, para. 87. 

24 9012/0011 (COD) Article 51(2). 
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The exchange of relevant information is a mutual obligation that is necessary to enable the LSA and 
the other CSAs to effectively fulfil their roles e.g. when determining whether there has been an 
infringement of the GDPR”. 


The mutual exchange of information is particularly important if no joint operations (Articles 60(2), 62) 
are envisaged by the LSA and no mutual assistance requests (Articles 60(2), 61) are relied upon to 
jointly gather relevant information. Without these additional procedures, which naturally require 
further engagement and coordination, the LSA and other CSAs have to rely on the mutual exchange of 
information as per Article 60(1)(2). 


3.3.1 The term “Relevant information” 

Which information is to be considered as “relevant” depends on the circumstances of each individual 
case. In principle, all information that is directly or indirectly conducive to the conclusion of the 
proceeding should be classified as relevant. This includes sufficient information about the factual 
elements and legal issues specific to the case. Information that is already known or publicly available 
does not necessarily need to be shared. 


The exchange of information is therefore not an end in itself, but serves all SAs involved to deal with 
the case and to be able to fulfil their role as SAs properly. For practical implementation, it is therefore 
imperative that all parties involved act appropriately, i.e. proportionately and in the spirit of good 
cooperation. Therefore, the question in each case should be basically what information every SA would 
necessarily need itself in order to deal with the case. 


For instance, in the case of a LSA, this refers to all relevant information gathered in dealing with the 
controller or processor — the LSA being “the sole interlocutor” of the controller (findings of 
investigations, reports, exchanges with the controller, records of meetings, further evidence etc.). 


If the information is especially substantial in amount and scope the LSA should find ways to provide 
summaries, extracts, reports to substantiate the arguments made in the draft decision. 


In the case of another CSA, this should translate into an obligation to proactively disclose, to the LSA 
as well as the other CSAs, all the relevant information regarding the case (complaint, data breach 
notification etc.) of which that SA is in possession and that is helpful in assessing the legal and factual 
situation of the case. This may include any pleadings, arguments, correspondence with data subjects 
or any findings made by the CSA in the course of e.g. the vetting phase, or national inspections that 
have led to the detection of a possible infringement at the national establishment of the controller in 
a cross-border context. 








For instance, the following information could be exchanged between the SAs: 


- Information that has consequences for the reallocation of the competences of the LSA and the 
distribution of roles/qualification of CSAs*° (e.g. change in controllership or main establishment, 
etc.) 


- Correspondence with data controller/data subjects on the subject of a complaint or investigation 





25 See also: EDPB, Decision 01/2020 on the dispute arisen under Article 65(1)(a) GDPR, at para. 134-136. 
26 See para. 5 above. 
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- Meetings with controllers or processors: Agenda, scope and task, minutes of the 
meeting/assessment of the outcome of the meeting, intended follow up actions 


- Minutes of hearings and rehearings — also related to single issues of the case 

- Questionnaires sent to the controller/processor 

- Possible first draft report of the investigation/inspection 

- Possible Expert reports (legal, technical) also from external providers 

- Intended scope of an investigation/Inspection report/minutes of investigations 


- Witness statements and other legal evidence, other relevant indications, experience in relation to 
the controller or processor or the data processing, administrative practice 


- Information required to set the right focus: for instance, for an investigation into a very technical 
subject matter, it is likely that information relating to the technical aspects is very relevant, where 
in other cases the technical aspects are less relevant 


- Note: The examples given above are non-exhaustive. Which information will be deemed by SAs to 
be relevant information will depend on the circumstances of the specific case. 





For exchange of such information, the EDPB Information system should be used. 


With regard to the data minimisation principle of Article 5(1)(c), it should be assessed case by case 
whether the communication of personal data is necessary. Personal data should be shared only if 
required to deal with a specific issue. 


The LSA and other CSAs may flag specific pieces of information as (highly) confidential, particularly 
when this seems necessary in order to meet requirements of confidentiality constraints laid down in 
national laws. In such a case, the SAs should inform each other immediately and jointly find legal 
options for a solution against the background that confidentiality provisions usually relate to external 
third parties and not to CSAs. In this regard, any information received that is subject to national secrecy 
rules should not be published or released to third parties without prior consultation with the 
originating authority, whenever possible. 


As regards requests for public access, without prejudice to national transparency regulations, SAs 
should consult each other before granting or refusing access to documents, which were exchanged 
during the cooperation procedure. 


3.3.2 Timing of the information exchange 

No specific timeline is provided in paragraph 1, as this is a general obligation irrespective of the timing 
involved. However, effective enforcement of the GDPR throughout the EU requires that all CSAs 
receive all relevant information in a timely manner, i.e. as soon as reasonably possible. Therefore, the 
EDPB considers the mutual obligation to exchange all relevant information necessarily to apply already 
prior to the submission of a draft decision by the LSA. 


In order to facilitate the reaching of consensus, the information should be shared at a moment where 
it is still possible for the LSA to take on board the viewpoints of the other CSAs. This should apply to 
any stage of the proceedings, and in particular, it should prevent the other CSAs from being presented 
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with accomplished facts, for example because certain stages of the proceedings may be precluded 
under national law. 


In this respect, Article 60 provides also ‘space for thought’ to both LSA and other CSAs in that there is 
room for facilitating the achievement of consensus through ‘informal’ exchanges of “all relevant 
information” without strict deadlines prior to triggering the ‘formal’ steps. The more comprehensive 
and timely the exchange of information between the SAs involved, the greater the likelihood of 
reaching a consensus as early as possible will be. 


The EDPB recommends therefore as a minimum standard that the LSA makes all efforts to proactively 
share, with the other CSAs, the scope and main conclusions of its draft decision prior to the formal 
submission of the latter. This enables the other CSAs to form their own views in that respect and timely 
flag possible questions to the LSA. The LSA may decide to address these issues prior to issuing the draft 
decision formally and thus before triggering the very strict procedure envisaged in Article 60(4) and 
60(5) for raising objections to the draft decision. 


After all, it should be kept in mind that the cooperation mechanism is intended to be supportive and 
serve the effective enforcement of data protection within the EU. SAs will need to develop best 
practices through the continuous gathering of practical experience by being flexible in choosing 
optimal ways for cooperation. 


4 ARTICLE 60(2) - MUTUAL ASSISTANCE AND JOINT OPERATIONS 


4,1 General 
Article 60(2) addresses specific forms of cooperation between the LSA and the other CSAs throughout 
the cooperation procedure provided for by Article 60, i.e. within the framework of the OSS mechanism. 


Article 60(2) goes beyond the duty to exchange all relevant information, provided for by Article 60(1), 
and provides for a specific kind of cooperation that the LSA may pursue if necessary in a concrete case: 
either requesting CSA(s) to provide mutual assistance or requesting CSA(s) to engage into a joint 
operation conducted by the LSA. 


The application of Articles 61 and 62 in the remit of Article 60(2) entails reading the provisions of those 
articles in conjunction with Article 60, and, therefore, they have to be adjusted to the precise context 
of a cooperation procedure and to the allocation of roles provided by the OSS mechanism, and in 
particular provided by Article 60(2). 


By specifying the main purposes of such cooperation, i.e. for carrying out investigations or for 
monitoring the implementation of a measure concerning a controller or a processor in another MS, 
Article 60(2) emphasises two stages of the cooperation procedure where those cooperation tools are 
applicable: firstly, during the investigatory phase, before the final decision is adopted ; secondly, during 
the implementation phase, after the final decision was adopted and notified to the controller or 
processor. 


4.2 Requirements of Article 60(2) 
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4.2.1 The LSA may request 

By referring to the LSA, this provision frames the action to be taken within the OSS mechanism while 
placing it within a specific case being handled, after the LSA has been identified. It should then be 
stressed that the possible resort to mutual assistance or to joint investigations pursuant to Article 60(2) 
is limited to the cooperation procedure related to the specific ongoing cross-border case. 


Following the LSA’s level of discretion to conduct the investigation or to follow-up the measures taken 
by the controller or processor to comply with its decision, the wording “may request” empowers the 
LSA to take the initiative, but only if it deems necessary or appropriate for the case at hand. It is up to 
the LSA to decide whether to make a request for mutual assistance or to have a joint operation, 
pursuant to Articles 61 and 62 respectively, as the GDPR does not impose on the LSA an obligation to 
use such possibilities. 


Article 60(2) only covers requests made by the LSA, and not requests from the CSA’ addressed to the 
LSA in the context of the Article 60 cooperation procedure, as those are already envisaged by Article 
60(1) under the “exchange of relevant information”. 


4.2.2. The term “At any time” 

This means that the LSA may send requests for mutual assistance or for a joint operation, whenever 
the LSA considers the action justified to fully exercise its competence throughout the cooperation 
procedure provided for Article 60. 


Indeed, within the same cooperation procedure, related to a specific case, the LSA may send several 
different requests, related to mutual assistance or to a joint operation or both. The LSA should bear in 
mind though that such requests should be necessary and adequate for the investigation and decision- 
making process or for monitoring the implementation by the controller or processor of the LSA’s 
decision. 


4.2.3. The other CSAs as addressees 

According to Article 60(2), the addressees of the requests by the LSA are in general the other CSAs, 
which have actively expressed to be concerned in the specific cooperation procedure~®. In case of 
Article 61 mutual assistance requests, this does not imply that all CSAs are automatically addressees 
of the requests or have to be involved in the action at stake. That would depend on the assessment of 
the LSA on who is in the best position to contribute to the ongoing case. Conversely, when the LSA 
intends to carry out joint operations, all of the relevant CSAs have the right to participate pursuant to 
Article 62(2)7°. 


In the last phase of the cooperation procedure, provided for in Article 60(10), which relates to the 
follow-up of the compliance of the LSA’s final decision by the controller or processor, again the LSA 
may decide, based on the specifics of the case at hand, which CSA(s) are to be involved in actions 


27 Pursuant to Article 56(5), whenever the LSA decides not to handle the case in view of its local nature, the CSA 
assumes then the leading role of the investigation and shall handle it according to Articles 61 and 62. If it happens 
that the CSA handling the case may need to request assistance to the LSA, Article 60 procedure does not apply, 
so Articles 61 and 62 will be directly applicable outside the scope of Article 60(2). 

28 See para. 36189 et seq. on the binding effect of the draft decision. 

29 However, the LSA is at liberty to extend the participation to SAs that are not CSAs. 
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intended to verify on the spot the implementation of the decision and it will send the assistance 
requests accordingly (e.g. the CSAs of the MS where the controller or processor have establishments). 


4.3 Requests for mutual assistance 

The mutual assistance instrument comprises a variety of possibilities for SAs to cooperate with each 
other, in order to implement and apply the GDPR in a consistent manner, taking into account the 
geographical dispersion of data controllers’ or processors’ establishments and of data subjects. 
However, the specific type of assistance requested will depend on the specific circumstances of the 
case, also taking into account that the LSA is the sole interlocutor of the controller or processor for the 
specific cross-border processing case being handled. 


In a cross-border case within the Article 60 procedure, the LSA can send to the CSA(s) a request for any 
type of mutual assistance that is considered to be helpful for reaching a decision in the specific case. 


During the investigatory phase, there are several situations where the LSA may need to request mutual 
assistance from other CSA(s). The most common one may be the case to ask for assistance of the CSA 
where the complaint was lodged (e.g. to seek for additional information to be provided by the 
complainant; to have certain facts checked or evidence collected in the organisation establishment of 
that MS). In such situations, only one CSA would be involved. 


However, the LSA may need to request the CSA(s) to provide information or to carry out an 
investigation in specific establishment(s) of the controller or processor in some MS, in view of the 
conditions under which the data is being processed or the partition of responsibilities among 
establishments. In these circumstances, the LSA will address the request to the relevant CSA(s). 


At the end of the Article 60 procedure, after the controller or processor has notified the LSA on the 
measures taken to comply with the LSA’s final decision, as per Article 60(10), the LSA, upon information 
on that fact to the other CSA(s), may still request the CSA(s) to provide mutual assistance, in the form 
of verification, if — and how — the establishment of that controller or processor in that MS implemented 
the decision. 


The mutual assistance requests sent under Article 60(2) should follow the general rules of Article 61, 
in what regards the purposes and reasons substantiating the request by the LSA on one hand, and the 
possible reply by the CSA(s) on the other. 


In accordance with Article 61(2), when receiving a request by the LSA, the CSA(s) shall take the 
appropriate steps to reply “without undue delay”, and in any case “no later than one month after 
receiving the request’. 


The principle of giving priority, to a certain extent, to the Article 60 procedure is already enshrined in 
Article 60(3) where the term “without delay” is used, as well as in the strict deadlines provided for in 
paragraphs 4 and 5. The term “undue delay”, used in Article 61, also stresses the need for the SA to act 
promptly, though the variety of actions covered by the mutual assistance requests may imply different 
timelines to fully give satisfaction to a request. In any way, the CSA(s) shall inform the LSA no later than 
one month after receiving the request “of the results or, as the case may be of the progress of the 
measures taken to respond to the request,” as per Article 61(2) in conjunction with Article 61(5). 
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4.4 Setting up joint operations 

In accordance with Article 60(2), the LSA may conduct joint operations pursuant to Article 62, in 
particular to carry out investigations or to monitor the implementation of a measure concerning a 
controller or processor established in another MS. 


Therefore, within the LSA’s leading role in the Article 60 procedure, whenever it considers that the 
ongoing case benefits from a joint investigation or from joint enforcement measures, the LSA may set 
up a joint operation by requesting the CSA(s) to engage in such action, though there is no obligation 
for a CSA to reply positively. 


A joint operation can be hosted by the LSA in its MS or it could be organized by the LSA as a joint 
investigation action of the CSAs to be deployed in several MS, where there are establishments of the 
controller or processor, to make verifications on the spot necessary for the outcome of the cooperation 
procedure. A joint operation can also be triggered by the LSA, as a joint enforcement measure of the 
relevant CSAs to monitor simultaneously the implementation of the LSA’s decision in each 
establishment of the controller or processor upon which the decision is binding. 


5 ARTICLE 60(3) — INFORMATION BY THE LSA AND DRAFT DECISION 
OBLIGATION 


Article 60(3) describes the decision-making process, which is a key step in the cooperation procedure 
between the LSA and the CSAs. The aim of this phase is to quickly find a consensus decision concerning 
the outcome of the case. 


Article 60(3) focuses on the duties of the LSA and establishes three key obligations: 


e communication of the relevant information on the matter to the CSAs without delay, 
e submission of a draft decision to the other CSAs for their opinion without delay, and 
e taking due account of the CSAs’ views. 


These obligations are to be regarded in line with the consensual approach established in Article 60(1). 


5.1 Article 60(3)(1): LSA’s obligation to share information without delay 

5.1.1 The term of “without delay” 

The term “without delay” is used in both sentences of Article 60(3). While sentence 1 contains the 
obligation of the LSA to communicate without delay the relevant information on the matter to the 
other CSAs, sentence 2 stipulates the LSA’s obligation to submit without delay a draft decision to the 
CSAs. 


Although the term "without delay" is used in various places in the GDPR, it is not further defined in 
Article 4. 


Since Article 60(3) is a legal provision under Union law, the term “without delay” must be interpreted 
autonomously from national law to ensure a uniform application of the GDPR. 


The term “without delay” was subject of the judgement of the CJEU (18.11.1999, C-151/98 P, Recital 
25) in the context of the Regulation (EU) No. 2377/90. The CJEU found that the Court of First Instance 
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(ECJ) was right to hold that Article 8(3)(b) does not specify exactly the period within which the 
Commission must propose to the Council the measures to be adopted and that in using the expression 
“without delay” the Community legislature, whilst requiring it to act swiftly, did allow the Commission 
a certain degree of latitude. 


Therefore, in accordance with the ruling of the CJEU the EDPB considers the term “without delay” in 
the context of Article 60(3)(1) as the obligation to act swiftly”®. 


The fact that the legislator has inserted the term "without delay" in this context indicates that it has 
seen a need for action in terms of increasing the speed in the information flow connected with the 
draft decision. Nevertheless, due to the diversity of cases, no specific deadline could be determined in 
this respect. Therefore, the EDPB considers the term of "without delay" to mean that the information 
must be provided not literally immediately or in a specific timeframe but without hesitation, i.e. within 
a review period to be measured according to the circumstances of the individual case. In summary, 
that means that the LSA has to act proactively and, as quickly as possible, appropriately to the case. 
This of course applies as well to the reaction by the other CSAs to requests by the LSA. 


To facilitate the planning of the other CSAs for their contribution to the draft decision, the LSA should 
consider how it is possible to support the scheduling of work of the other CSAs. This could be done for 
example, where appropriate, by the way of creating an indicative timetable. 








Example 2: Prior to the investigation, the LSA proactively and quickly shares a timetable of the steps it 
intends to take. In due time, following the completion of the investigation, the LSA sends a summary 
of the results of the investigations to the CSAs in form of a note, with a short, reasonable deadline?! 
for comments in the context of an “informal consultation” in the EDPB Information system. 


Following this, it shares the relevant information gathered and updates the timetable, adding a date 
for when it intends to share a preliminary draft decision, by when it requests comments by the CSAs 
on this preliminary draft decision and during which periods it intends to consult the affected parties. 





As a best practice, the LSA and the CSAs may agree that the obligation to exchange relevant 
information “without delay” is fulfilled if there is a proactive, quick and comprehensive exchange of all 
relevant information, which enables the CSAs to screen, assess and react to it sufficiently early. 


5.1.2 The term of “relevant information” 
With regard to the concept of relevant information, reference can be made to the remarks provided 
under section 3.3. 


Article 60(3)(1) establishes an information obligation of the LSA towards the CSAs in contrast to Article 
60(1)(2), which regulates a mutual exchange of information between LSA and other CSAs. The 
communication of relevant information by the LSA according to Article 60(3)(1) in conjunction with 


30 In para. 115 of its opinion in the Case C 645/19 the Advocate General Bobek states that as a matter of 
principle, the GDPR requires, in cases concerning cross-border processing, the LSA to act promptly. Although 
acting promptly is not a synonym for acting swiftly, the EDPB considers that if the LSA acts proactively and as 
quickly as possible it also meets the requirements of acting promptly. 

31 What is understood as reasonable has to be assessed on a case by case basis and may vary from a few weeks 
up to a month or more. 
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Article 60(1)(2) is ultimately related to the submission of the draft decision. Relevant information that 
is accessible only to the LSA should be transmitted to the other CSAs via the EDPB Information system. 


The core idea of the cooperation procedure is that the consensus decision is reached and the case is 
resolved by collaborative interaction between the LSA and the other CSAs. Therefore, the other CSAs’ 
involvement in the cooperation procedure is not limited to the right to express a relevant and reasoned 
objection pursuant to Article 60(4). In particular, before the creation of the draft decision the CSAs 
should be able to contribute to the overall procedure and may express their views also before the 
creation of the draft decision. 


To that end, the LSA should in general endeavour to exchange preliminary results prior to submitting 
the draft decision, in particular, when divergent views could be expected, or when the other CSAs may 
need some time to familiarize themselves with the subject matter. This enables the LSA to be informed 
about the views of the other CSAs, in order to take these views duly into account already in preparation 
of the draft decision. 








Example 3: At an early stage, after a preliminary examination of a complaint-based case, indicating 
further use of personal data for other purposes by business partners, the LSA shares this discovery 
with the other CSAs to seek an agreement on whether to proceed exclusively within the remit of the 
complaint or to extend the scope of the investigation into such secondary data processing. 


Example 4: Upon conclusion of the fact-finding, the LSA provides a summary of the main results to the 
other CSAs, and, as appropriate in this case, also identifies key-issues for their consideration, in order 
to start building a common ground for the assessment of the merits of the case. This anticipated 
interaction between the LSA and the other CSAs proves essential to detect from the outset different 
points of view and, consequently, to promote as much as possible the necessary convergence. 


Example 5: At a later stage, closer to the submission of the draft decision, all involved SAs have an 
overview of the facts and also an assessment of the potential infringements found during the 
investigation phase. These preliminary results and further evaluation include provisions that have 
possibly been violated and envisaged measures to be taken by the SAs under Article 58(2) and under 
Article 83(2). 





As set out above and in the examples, the exchange of controversial or divergent legal views, as well 
as the exchange of views on complementary steps taken or not, and/or elements provided or not, 
should be general practice. This could prevent the discussion on different interpretations of the GDPR 
and the decision on them from being shifted to the dispute resolution procedure. 


Nevertheless, where the LSA decides to trigger an inquiry on its own initiative and not on the basis of 
elements forwarded by the other CSAs, it does so within the remit of its discretionary power and, 
therefore, the views of the other CSAs cannot result in compelling the LSA to change the scope of its 
inquiry*2. 


32 Nonetheless, a CSA may raise, in a last resort situation, an objection regarding the scope as highlighted in 
para. 9 of the EDPB Guidelines 09/2020 on relevant and reasoned objection, provided that it meets all the 
requirements posed in Article 4(24), as explained in the Guidelines. 
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5.2 Article 60(3)(2): LSA’s obligation to issue a “Draft Decision” 

5.2.1 Legal obligation to submit a draft decision 

Article 60(3)(2) sets forth an obligation on the LSA to submit a draft decision to the other CSA(s). This 
is shown by the use of the “shall” form coupled with the verb “submit”, which entails a rule to be 
followed in all cases where Article 60 is applicable. 


The submission of a draft decision under Article 60(3)(2) is an obligation applying to the LSA in the 
context of all OSS procedures. The competence of the LSA is grounded in Article 56(1), which is to be 
regarded as ‘lex specialis’ whenever an issue arises in respect of cross-border processing operations. 
The competence of the LSA under Article 56(1) is exercised in such cases “in accordance with the 
procedure in Article 60”; therefore, the LSA acting within the framework of the OSS is bound by the 
provisions of Article 60, including Article 60(3)(2). 


Accordingly, the LSA is required to submit a draft decision to the other CSAs in all cases, also when 
complaints are withdrawn by the complainant after the Article 60 procedure has been initiated or 
where no material (final) decision is issued according to national law. 


Also in these cases, the draft decision serves as a final coordination between all supervisory authorities 
involved in the OSS procedure including the legal opportunities provided in Article 60(4) et seq. In 
complaint-based cases, the draft decision also provides the ground for the CSAs decisions pursuant to 
Article 60(8) and (9). 





Example 6: After a complaint-based OSS proceeding has been initiated, the controller promptly 
eliminates the infringement after being approached by the LSA. In view of the case and the 
behaviour of the controller, the LSA concludes that the case may be closed. The LSA issues a draft 
decision stating its intention to close the case, which contains thorough reasoning for their course 
of action, and the remaining steps provided for by the Article 60 procedure are followed. 











As explained in section 3.2 above and recalled by the EDPB in the RRO Guidelines 2/2020, “the focus 
of all SAs involved should be on eliminating any deficiencies in the consensus-building process in such 
a way that a consensual draft decision is the result”. The LSA shall submit the draft decision to the 
other CSAs “for their opinion”, i.e. the purpose is to consult the CSAs on the substance of the draft 
decision (see also reference in Article 60(4) to the “consultation” that the LSA is required to carry out 
“in accordance with paragraph 3 of this Article”). The consultation to which the submission of the draft 
decision is geared should therefore be seen in the light, once again, of the consensus objective 
underpinning the whole Article 60 mechanism (see the section 5.2.4 below on “take due account of 


their views”). 


As a best practice, the EDPB recommends that the LSA informs the other CSAs beforehand of the 
intention to submit a draft decision. This could be in line with an indicative timetable the LSA provided 
as part of the relevant information (according to Article 60(1)), in particular for cases which involve a 
large number of CSAs and/or which raise sensitive questions. In any case, knowing what is in the 
pipeline beforehand will help the CSAs organise their assessment of the draft decision and exploit the 
four-week deadline of Article 60(4) in full. 


Regarding the “submit” part of the obligation, the EDPB recommends that such submission should only 
take place by way of the EDPB Information system so that certainty can be achieved as to the date of 
the submission, which is the starting point for the running of the four-week period mentioned in Article 
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60(4), and that all the CSAs can receive the draft decision simultaneously. This approach will ensure 
security and confidentiality of the submission and is also necessary in light of possible objections to 
the draft decision and disagreements between LSA and CSA, triggering the Article 65(1)(a) procedure”. 
Use of the EDPB Information system appears to be the most appropriate channel to ensure a clear 
timestamp for the submission of the draft decision also in pursuance of Article 60(12). 


As for the contents of the submission, in principle the draft decision should be such as to contain all 
the elements required for the CSAs to assess it (see section 6.2.2 below). Moreover, in particular for 
cases resulting in the adoption of a corrective measure and involving a large amount of relevant 
information exchanged to understand the reasoning and the analysis leading to the draft decision, the 
“relevant information” for the purposes of the draft decision should have been exchanged before 
submitting the draft decision in the light of the consensus objective underpinning the whole 
cooperation procedure. In other, simpler cases, where the draft decision is self-explanatory and no or 
very little relevant information needs to be exchanged, the relevant information may be shared along 
with the draft decision. Thus, in principle, the obligation under Article 60(3)(2) is for the LSA to submit 
only the draft decision as such. 


Furthermore, the EDPB recalls that, where it is applicable under national law, the LSA should make 
sure that the draft decision it submits in this phase is fully compliant with the national law provisions 
regarding the right to be heard of the parties targeted by it (in particular the controller/processor at 
issue and the complainant, if a complaint has to be dismissed or rejected according to the applicable 
national laws). The LSA is therefore not required to submit, jointly with the draft decision and at the 
same time, such documents as may be necessary to provide evidence of compliance with the right to 
be heard, but it should reference the steps taken to ensure such compliance in the draft decision itself. 


5.2.2. The term of “draft decision” 

The submission of a draft decision is to be considered as one of the key elements within the 
cooperation mechanism as it constitutes on the one hand the decisive and final opportunity for mutual 
consultation on remaining disagreements and on the other hand, the only opportunity for the other 
CSAs to express reasoned and relevant objections. 


The GDPR itself does not define the concept of the draft decision. In view of the meaning and purpose 
of the cooperation procedure, the notion of a draft decision at EU level should be subject to the 
development of common minimum standards to enable all involved SAs to participate adequately in 
the decision-making process. 


According to Article 288(1) TFEU, a decision is an act of exercising [the Union’s] competences. In this 
context, the GDPR uses the terms of “tasks” (Article 57) and “powers” (Article 58) to establish the 
competences of data protection authorities. 


Regarding legally binding measures supervisory authorities are empowered to take, a description of 
formal requirements can be found in Recital 129: 


33 Indeed, Article 11(2), letter d) of the RoP requires the LSA to provide “documentation proving the timing and 
format of the provision of the (revised) draft decision” to enable the Secretariat to verify that the draft decision 
(or revised draft decision) and the objections were submitted within the applicable deadlines. 
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e Written form 

e Clear and unambiguous wording 

e Indication of the SA which has issued the measure?’ 
e Date of issue of the measure 

e Signature of authorised SA staff 

e Reasons included 

e Reference to the right of an effective remedy. 


These formal aspects are in line with the ECJ case law on decisions of EU bodies as per Article 288(1)*° 
TFEU as well as with the Charter of Fundamental Rights?°. Even though these provisions are supposed 
to regulate EU bodies, they provide guidance and may allow conclusions on the form and content of a 
draft decision as the respective competences are conferred on the SAs by Union law. 


The previous conditions lead to the interpretation that every decision that is aimed at legal 
consequences needs to include a description of relevant facts, sound reasoning and a proper legal 
assessment. These requirements essentially serve the purpose of legal certainty and legal protection 
of the parties concerned. Applied to the area of data protection supervision this means that the 
controller, processor and complainant should be able to acknowledge all the reasons in order to decide 
whether they should bring the case to trial?’. Having regard to the decision making process within the 
cooperation mechanism, CSAs likewise need to be in the position to decide on possibly taking actions 
(e.g. agree to the decision, provide their views on the subject matter). 


According to Article 60(3)(2) the term “decision” is modified by the prefix “draft”. A draft generally 
names a document, which is not final. It is an earlier version of the document that still needs a further 
step for completion. Apart from that final step, a draft contains all elements of the final document, but 
may be subject to further discussion or adjustment. As a result of such discussions, the draft can either 
be accepted by reviewers or modified according to their remarks. This is consistent with the wording 
of the GDPR, which states that the draft decision is to be submitted to the other CSAs “for their 
opinion”. 


In order to fulfil their duties as CSAs in the framework of a cooperation procedure, it is necessary for 
the other CSAs to be able to assess the case on the basis of comprehensive documentation. The other 
CSAs need to be in the position to fully understand the case, the LSA’s conclusions and the reasoning, 
which have led to those conclusions. 








Example 7: In order to be able to understand the appropriateness of a fine, the other CSAs must know 
the amount of the proposed fine and the specific circumstances of the assessment. This will regularly 
be explained ina comprehensible manner in the context of a decision that meets the above-mentioned 
minimum standards. 





34 This includes the dismissal/rejection of a complaint. 

35 Cf. ECJ, Joint Cases 11/66 (“legal effects which are binding“); ECJ, C 317/19 P (“examine their complaint in 
sufficient detail and to give adequate reasons“), ECJ, Joined Cases 8 to 11/66 (“reasons for this decision with 
sufficient clarity“); ECJ, C-24/62 (“principal issues of law and of fact upon which it is based”). 

36 Article 41(2)(c) CFR (“obligation of the administration to give reasons for its decisions“). 

37 See also: Recital 129, last sentence. 
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Taking into account the findings stated above, a draft decision is a provisional suggestion in the same 
form as a final decision would be. The only difference apart from procedural considerations between 
a draft decision and a final decision is that the step of the (final) consultation with the other CSAs has 
not been executed and the fact that the draft decision is not yet externally binding. If no relevant and 
reasoned objections according to Article 60(4) and (5) are expressed, the draft decision becomes 
legally binding for all SAs (cf. Article 60(6))*°. 


In view of the aforementioned constitutional requirements for a legal decision within the meaning of 
Union law, and against the background of the meaning and purpose of the cooperation procedure, it 
appears necessary that the draft decision in the sense of Article 60(3)(2) corresponds in form and 
content to the decision that the competent SA is to adopt in the specific case. In this respect, the EDPB 
considers the notion "draft" to refer only to the provisional nature resulting from the mandatory 
involvement requirement of Article 60(3)(2). 


In cases where complaints are withdrawn after the Article 60 procedure has been initiated or where 
no material (final) decision is issued according to national law, the draft decision should be modified 
as is appropriate to the case with a view to providing the findings in line with paragraph 113 above. 
This means that the draft decision must in any case indicate the intention of the LSA to close the case 
and sufficient reasoning appropriate to the case, which shall, at a minimum, enable the other CSAs to 
defend the case within their jurisdictions. 


The EDPB points out further that, in principle, the existing information obligations under the 
cooperation procedure do not affect the form and content of the draft decision. Continuous 
transparency during all stages of the procedure is vital, but it does not affect the need for a proper 
description of the case and the legal assessment as a part of the draft decision itself. 


The cooperation system designed by the legislator suggests that consensus on all relevant matters 
regarding the respective case should be strived for at an earlier stage by the competent SAs through 
continuous exchange of information. Therefore, the EDPB would like to emphasise that the focus of all 
SAs involved should be on eliminating any deficiencies in the consensus-building process in such a way 
that a consensual draft decision is the result. 


These statements apply without prejudice to any additional requirements for decisions that may arise 
from respective national law. 


5.2.3. The term of “without delay” regarding the submission of the draft decision 

According to Article 60(3) (2), the LSA shall submit the draft decision to the other CSAs “without delay”. 
A timely submission of the draft decision also alleviates the risks for the protection of the fundamental 
rights and freedoms of data subjects, since corrective measures taken in due time by SAs prevent 
continuing infringements. 


As regards the legal characterisation of the term “without delay”, the analysis carried out in section 
5.1.1 above applies. Therefore, the LSA has to begin swiftly to create the draft decision in order to 


38 At this stage, it should be clarified whether the decision will be finalised via Article 60(7), (8) or 9. See para. 
227. 
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submit it to the other CSA(s); nevertheless bearing in mind the complexity and the variety of cases, the 
timeline in which the LSA needs to submit swiftly the draft decision can be quite different. 


What time is necessary for the submission of the draft decision must be assessed on the basis of an 
objective standard. The characteristics of the individual case and the overarching obligation to 
cooperate ”in an endeavour to reach consensus” set out in Article 60(1), which in this case refers to 
the phase preceding the submission of the draft decision, shall be considered as well. 








Example 8: A relatively straightforward investigation into a complaint regarding data subjects rights, 
whose outcome is to be disclosed to the other CSA as being relevant information pursuant to Article 
60(3)(1), should enable the LSA to submit the draft decision shortly after the conclusion of the 
investigations. 


In cases with complex findings and investigations, the LSA may be legitimised to take some time to 
submit the draft decision after the conclusion of the investigations (as made known to the CSAs)”. 
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It should be pointed out that, pursuant to Article 41(1) CFR, the complainant has the right that his or 
her complaint is handled within a reasonable time. The ECJ has stated in a judgement of 8 May 2014 
(C 604/12) that the right to good administration, enshrined in Article 41 of the Charter, reflects a 
general principle of EU law. This notion must also be respected in the execution of Union law 
throughout applying Member State administrative law like in the Article 60 procedure - all the more 
so considering that Recital 129 recalls that the powers of SAs (such as powers of investigation and 
corrective powers, including sanctions) should be exercised “(...) fairly and within a reasonable time”. 
Thus, the timeframe with which a LSA may submit a draft decision in a complaint-based case should 
be such as not to entail that the handling of that complaint requires unreasonable time. 


5.2.4 The term of “taking due account of their views” 

To allow the LSA to take into account the views of other CSAs, the other CSAs are tasked with 
expressing their views as early as possible in the procedure. The views to be expressed are, thus, 
understood in a more extensive way than only relevant and reasoned objections. Indeed, Article 
60(3)(2) refers to a broader concept than the mere consideration by the LSA of relevant and reasoned 
objections (Article 60(4) and (5)), including also comments, expression of support or remarks. 


The EDPB considers that the LSA has the obligation to take due account of the other CSAs’ views prior 
to and after the submission of the draft decision, as the obligation to endeavour to reach consensus 
pervades the entire cooperation procedure and is not terminated by the submission of the draft 
decision. 


For this purpose, the draft decision should already address as much as possible the arguments and 
views shared by the other CSAs. Recital 125(2) states that the LSA should closely involve and coordinate 


39 It should be recalled that the need for a consensual scoping of the inquiries in the individual cases has been 
recognised by the EDPB in the RRO Guidelines 09/2020 (see para. 28): “In procedures based on a complaint or on 
an infringement reported by a CSA, the scope of the procedure (i.e. those aspects of data processing which are 
potentially the subject of a violation) should be defined by the content of the complaint or of the report shared by 
the CSA: in other words, it should be defined by the aspects addressed by the complaint or report. In own-volition 
inquiries, the LSA and CSAs should seek consensus regarding the scope of the procedure (i.e. the aspects of data 
processing under scrutiny) prior to initiating the procedure formally.” 
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the CSAs already in the decision-making process. To what extent this is necessary may vary from case 
to case. 


The obligation for the LSA to take due account of the other CSAs’ views in preparing the draft decision 
can also be inferred from the wording of Article 60(3)(2) to the extent that it relates to views expressed 
before the submission of the draft decision. The obligation for the LSA to take due account of the other 
CSAs’ views after submitting the draft decision requires that the LSA considers not only relevant and 
reasoned objections but also comments or remarks, expressed during the period provided in Article 
60(4) and (5). 


The obligation to take due account means that the LSA will have to consider the views and arguments 
of the other CSAs in substance, using due diligence, as the cooperation procedure aims for a consensual 
decision. 


As a best practice, the LSA should react to the views provided by all CSAs. The overarching obligation 
of endeavoring to reach consensus places concomitant obligations on both the LSA and the other CSAs. 
This means that the LSA is obliged to take account of all the views. However, the LSA is not obliged to 
follow each view that has been expressed. This is in particular the case where there are contradictory 
views among the other CSAs. 


Article 60(3)(2) uses the wording “take due account” of the other CSAs views, whereas Recital 130(2) 
refers to “take utmost account’” of the view of the CSA with which the complaint has been lodged 
when taking measures intended to produce legal effects, including the imposition of administrative 
fines. The different wording (“utmost” instead of “due”) reflects the specific role of the CSA with which 
the complaint has been lodged and suggests that this CSA’s views have a more significant influence on 
the draft decision. This is due to the close link between this CSA and the case, because the CSA acts as 
a single point of contact for the complainant and, additionally, this CSA may be required to adopt and 
defend a decision, pursuant to Article 60(8) and (9). 


6 ARTICLE 60(4) — ASSESSMENT OF THE OBJECTIONS AND 
POSSIBILITY TO TRIGGER A DISPUTE RESOLUTION PROCESS 


6.1 Purpose of the provision 

Article 60(4) concerns the period immediately following the submission of the draft decision by the 
LSA. Upon the submission, a four-week deadline begins to run during which any CSA may raise 
objections to the draft decision. 


Within the individual provisions of Article 60, Article 60(4) has a unique position insofar as it establishes 
a link between the cooperation and consistency procedure. Where a CSA “expresses a relevant and 


40 In cooperation procedures under Article 56, in which the LSA has exercised its right under Article 56(4)(1) and 
decided to handle the case itself, the GDPR provides for an even more significant involvement of the CSA. In 
these cases, the CSA may submit to the LSA a draft for a decision according to Article 56(4)(2) and the LSA is 
expressly required to take “utmost account” of such draft. This wording suggests a higher threshold by 
introducing an even increased obligation for the LSA to consider the views of the CSA in comparison with “take 
due account of their views”. 
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reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the 
relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, 
submit the matter to the consistency mechanism referred to in Article 63.” This deserves special 
attention in light of the fact that in this scenario the goal of reaching a consensus between the SAs, 
which is essential to the cooperation procedure, could not be achieved. 


The EDPB recalls that the achievement of a consensual agreement on the outcome of the case is the 
ultimate goal of the whole procedure established by Article 60 and that reaching consensus should 
take priority over initiating the dispute resolution process. The duty of cooperation applies to every 
stage of the procedure and for all involved SAs. With regard to Article 60(4), this means that both other 
CSAs and LSAs should carefully follow the previous steps established in Article 60(1) and (3). 


6.2 Relevant and reasoned objections by a CSA 

After having been consulted by the LSA, in accordance with Article 60(3), the other CSAs may raise 
relevant and reasoned objections within a deadline of four weeks, since the CSAs must have been 
consulted “in accordance with paragraph 3”. 


6.2.1 Calculation of the deadline 

The four-week period starts once the LSA has submitted the draft decision according to Article 60(3)(2) 
via the EDPB Information System. The calculation of the deadline for raising possible objections shall 
be done on the basis of Regulation 1182/71*7. According to Article 3(2)(c) of Regulation 1182/71, “a 
period expressed in weeks...shall start at the beginning of the first hour of the first day of the period, 
and shall end with the expiry of the last hour of whichever day in the last week...is the same day of the 
week, or falls on the same date, as the day from which the period runs”. 


If an event from which a weekly period starts to run occurs, for example, on a Monday, the period also 
ends on Monday, in this case with the expiry of Monday (i.e. 11:59:59 p.m.) four weeks later. 


The period includes public holidays, Sundays and Saturdays, since the GDPR does not expressly exclude 
these*?. However, when the last day of a period is a public holiday, Sunday or Saturday, the period shall 
end with the expiry of the last hour of the following working day, thus the deadline ends on the 
following working day*?. Considering the European nature of the cooperation procedure, the holidays 
published in the official journal for the EU institutions“ should be considered for the purpose of 
determining public holidays. Further, the time zone of where the EDPB is established should be used. 


To avoid having the expiration date fall during the weekend, the initiator (i.e. LSA) should trigger the 
workflow only on working days and should make sure that the deadline does not expire on one of the 
EU holidays”. In the spirit of cooperation, the EDPB encourages LSAs to consider the possible impact 


41 Regulation (EEC, Euratom) No 1182/71 of the Council of 3 June 1971 determining the rules applicable to 
periods, dates and time limits, Article 40 RoP confirms that “In order to calculate the periods and time limits 
expressed in the GDPR and in these Rules of Procedure, Regulation 1182/71 of the Council of 3 June 1971 
determining the rules applicable to periods, dates and time limits shall apply”. 

42 Article 3(3) of Regulation 1182/71. 

43 Article 3(4) of Regulation 1182/71. 

44 Annually updated by Commission Decision, see for 2021: Commission Decision of 2 March 2020 on public 
holidays for 2021 2020/C 69/05 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32020D0303 
%2801%29); with the exception of the national holidays of Belgium and Luxembourg. 

45 As no automatic extension of the deadline is currently ensured in the EDPB Information system. 
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of extended holiday periods before submitting its draft decision to allow the other CSAs as much time 
as possible to react to its draft decision. 


During the four-week period, a CSA may express one or more objections to the draft decision 
submitted by the LSA. However, in view of the requirements to raise relevant and reasoned 
objection(s) to the draft decision as a whole, the CSA should provide their objections in one single 
submission, though clearly distinguishing the different objections. This best practice will facilitate the 
analysis by the LSA and eventually by the EDPB, in case the dispute resolution mechanism is triggered. 
If, after inserting the objection(s) in the EDPB Information system, the CSA wishes to modify its 
submission, in any way and for any reason, this would still be possible, as long as this remains within 
the deadline provided for in Article 60(4). Therefore, the CSA should delete the previous version of the 
objection(s) and upload the new one in the EDPB Information system”, so the submission available for 
the LSA and the other CSAs is always the updated text of the objection(s). 


6.2.2 Relevant and reasoned objections 

One of the key elements in this stage of the cooperation procedure is a common understanding of the 
notion of the term “relevant and reasoned objection”. Article 4(24) defines relevant and reasoned 
objection as an objection to a draft decision as to whether there is an infringement of this Regulation, 
or whether envisaged action in relation to the controller or processor complies with this Regulation, 
which clearly demonstrates the significance of the risks posed by the draft decision as regards the 
fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal 
data within the Union. 


As the EU legislator suggested (end of Recital 124), the EDPB has issued guidelines on what constitutes 
a relevant and reasoned objection. The following paragraphs therefore only contain clarifications that 
are essential for the Article 60 procedure and are not already contained in the Guidelines 09/2020. 


The right to raise an objection under Article 60(4) is available to each CSA individually and 
independently. Therefore, it does not depend on whether another CSA may already has raised an 
objection on the same matter. To the extent that a CSA objects on the basis of several items, each 
must separately meet the requirements for a relevant and reasoned objection under Article 4(24)*”. 
Consequentially, the mere endorsement of or referral to another CSA’s relevant and reasoned 
objection does not constitute a relevant and reasoned objection on its own. In this context, for reasons 
of legal certainty as well as clarity and reliability within the objection process, the EDPB recommends 
that each CSA submit its own and complete (formal) objection to the LSA even if one CSA wishes to 
concur with the objection of another CSA”. 


46 The EDPB Information system will automatically notify the LSA and other CSAs of the new addition. 

47 EDPB Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679, available at 
https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-092020-relevant-and-reasoned- 
objection-under_en. 

48 According to the EDPB Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679, 
referencing another objection cannot be seen as meeting the requirement of Article 4(24). In para. 7 the 
Guidelines clarify that “(...) a submission by a CSA should in principle explicitly mention each element of the 
definition in relation to each specific objection.” Further, in para. 8 the Guidelines stipulate that “[t/herefore, the 
standard of “relevant and reasoned objection” is grounded on the assumption that the LSA’s obligation to 
exchange all relevant information is complied with, allowing the CSA(s) to have an in-depth understanding of the 
case and therefore to submit a solid and well-reasoned objection.” 
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In order to meet the threshold set by Article 4(24), a submission by a CSA should in principle explicitly 
mention each element of this legal definition in relation to each specific objection. If possible, as a 
good practice, the objection may also include a new wording proposal for the LSA to consider, which 
in the opinion of the CSA allows remedying the alleged shortcomings in the draft decision. 


As required by Article 60(12), the CSAs shall submit the objections via an electronic and standardised 
format. The EDPB Information System shall be used for these purposes. 


Amere “comment” expressed by a CSA in relation to a draft decision does not amount to an objection 
within the meaning of Article 4(24). The existence of comments shall therefore not give rise to the 
obligation to trigger the Article 65(1)(a) procedure if the LSA decides not to give any effect to the 
comment’’. 

6.2.3 Assessment of the objections to the draft submitted under Article 60(4) 

The LSA should make use of all possible means to exchange with the other CSAs on the issues raised in 
the relevant and reasoned objection. The EDPB recalls that the draft decision of the LSA should 
primarily be self-explanatory. Nevertheless, in response to an objection, the LSA should, also as a good 
practice, provide the CSA with explanation as to why a certain position has been taken in the draft 
decision, and it should as well provide the CSA with the opportunity to further explain its objections 
with undue delay. The LSA may also take the initiative to organise meetings, or otherwise use informal 
consultation to ensure that the reasoning employed by the respective authorities is understood. 


After this further cooperation following the raising of an objection, the CSA may consider whether the 
LSA’s response adequately addresses its concerns and, if so, the CSA may consider withdrawing its 
objection®®. It may be the case in particular, when, following the LSA's explanations, the conflicting 
views are only marginal in nature, in respect of the risks to the fundamental rights and freedoms of 
the data subjects. 


If a CSA decides to withdraw its objection it should always explicitly identify the objection it intends to 
withdraw and be explicit that it wishes to withdraw said objection. This withdrawal may take place 
during the four-week period, or in case of a revised draft decision two-week period, following the 
submission of the draft decision, in which case the withdrawal should take place in the same EDPB 
Information system notification in which the objection has been raised. The withdrawal may as well 
take place after this period®*. The LSA should make sure to document when this happened and notify 
this withdrawal to other CSA(s) without undue delay, via the EDPB Information system, as this 
information is to be understood as relevant information under Article 60(1). 


When objections from different CSAs contradict each other on the assessment of a specific matter”?, 
the LSA should indicate which objections it intends to follow and to what extend/how it intends to 
follow them. On the other hand, the other CSAs should carefully consider whether a withdrawal is 


49 See para. 17 of the EDPB Guidelines 03/2021 on Article 65(1)(a) GDPR (version for public consultation). 

5° After the period of the procedure expired, the CSA may consider not raising again its objection if the draft 
decision is to be revised. 

51 As provided for in para. 27 of the EDPB Guidelines 03/2021 on Article 65(1)(a) a CSA may withdraw even after 
an Article 65(1)(a) procedure has been initiated. . 

52 A constant exchange of information between the SAs involved could prevent such situations. 
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appropriate in light of the opinions expressed by the LSA and/or other CSAs*?. It is important to 
remember that the overarching aim of Article 60 is for decisions to be made by consensus, insofar as 
possible. This goal regards the LSA as well as on the other CSAs. 


6.3 Submission to Board 
Article 60(4) provides for two alternative conditions, each of which has the effect of requiring the LSA 
to seek a decision from the Board: 


° The LSA is of the opinion that the objection(s) is/are not relevant or reasoned. 
° The LSA does not follow the relevant and reasoned objection(s). 


In the first situation, the LSA is of the opinion that the objection submitted by the CSA does not meet 
all the requirements set out in Article 4(24), i.e. it considers that the objection is either not relevant 
and/or not reasoned, or both, in terms of whether there is an infringement of the GDPR and/or 
whether the envisaged action in relation to the controller or processor complies with the GDPR. In the 
second situation, the LSA considers the objection(s) to be both relevant and reasoned, but does not 
intend to follow them. 


“The matter’ to be submitted to the Board only concerns objections that the LSA does not intend to 
follow or that the LSA does not consider to meet the threshold stipulated in Article 4(24). Therefore, 
the items on which there is no dispute are not to be addressed via the dispute resolution under Article 
65(1)(a). 


Although Article 60(4) does not provide for an explicit time limit for the submission, the fact that a 
decision is pending which affects the risks to the fundamental rights and freedoms of the data subjects 
should result in the requirement of a submission as soon as possible as appropriate to the individual 
case”. 


On the other hand, in situations where the LSA wishes to follow some objections, but does not wish to 
follow other objections and/or does not consider them to be relevant and/or reasoned, the LSA should 
submit a revised draft in the procedure as per Article 60(5), according to the following section. The LSA 
should indicate clearly, through an informal exchange, which of the objections it intends to follow 
within the revised draft decision and how it intends to do so. Further, the LSA should indicate clearly, 
which objections have been noted as being the subject of a possible later dispute resolution via Article 
65(1)(a)°°. 


Nonetheless, as the revised draft decision is a new instrument, if they want to sustain their objections 
previously raised, the other CSAs will have to reiterate their position by (re)submitting their objections 
once the revised draft decision is shared. The EDPB is of the opinion that this course of action should 
be followed because it will allow relying on the dispute resolution procedure only for the objections 
that remain on the table in spite of the efforts made by all the parties to first seek a consensual 
solution. 


53 The CSAs should bear in mind that, should it come to a dispute resolution, the EDPB will adopt its decision 
based on a (qualified) majority vote. 

54See also Recital 129, sentence 4 and 5. 

55 See also EDPB Guidelines 03/2021 on Article 65(1)(a). 
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7 ARTICLE 60(5) - THE REVISED DRAFT DECISION 


7.1 Submission to the other CSAs 


7.1.1 The LSA intends to follow 

Article 60(5)(1) gives the LSA the possibility to follow a relevant and reasoned objection. It is important 
to note that to follow a relevant and reasoned objection means to follow such objection as it is, 
because the objection at issue is found by the LSA to be both relevant and reasoned and the LSA 
concurs with the reasoning. 


The focus is on the “intention” to follow. The LSA’s intention to follow an objection is reflected in the 
fact that the LSA submits a revised draft decision. To what extent the revised draft decision does follow 
the relevant and reasoned objection as a whole raised by a CSA is, among other things, the subject of 
the procedure regulated by Article 60(5)(2) (see below, section 7.2), and ultimately by Article 65(1)(a) 
in case of disputes. 


It should also be recalled that the threshold set forth by the EU legislator in the definition of a relevant 
and reasoned objection under Article 4(24) has to be met also in light of the manner the relevant and 
reasoned objection is to be structured by a CSA as set in the Guidelines 09/2020°°. This impacts the 
assessment of the relevant and reasoned objection by the LSA. Still, it is unquestionable that the 
intention to follow a relevant and reasoned objection is in line with the consensus objective underlying 
the whole Article 60 procedure. The revision should aim to completely address the risk posed by the 
initial draft decision as regards the fundamental rights and freedoms of the data subjects and, where 
applicable, the free flow of personal data within the Union that was identified in the objection. 


The EDPB recalls that the LSA should make use of all possible means to exchange with the other CSAs 
on the issues raised in the relevant and reasoned objection. The LSA may take the initiative to organise 
meetings, or otherwise use informal consultation to ensure that the reasoning employed by the 
respective authorities is understood”. In any case, this exchange should lead to the fact that the 
content of the revised draft decision does not come as a surprise to the other CSAs, as it should be the 
result of a sincere cooperation. 


7.1.2 The obligation to submit a revised draft decision 

The LSA is obliged to submit a revised draft decision if it intends to follow a relevant and reasoned 
objection, i.e. there is no alternative under the GDPR as clarified by the use of the “shall” auxiliary with 
the verb “submit”. Indeed, the alternative to submitting a revised draft decision can only consist in 
submitting the matter to the consistency mechanism as per Article 60(4) final sentence. 


It should be pointed out that it is only a relevant and reasoned objection the LSA intends to follow that 
triggers the obligation on, and the possibility for the LSA to submit a revised draft decision under the 
GDPR. Article 60(5)(1) (and Article 60(4), for that matter) only refers to the “relevant and reasoned 
objection” submitted by a CSA — contrary to, in particular, Article 60(3), which refers to the “views” of 
the other CSAs*®. 


56 For details, see EDPB Guidelines 09/2020 on Relevant and Reasoned Objection para. 6-8. 
57 See also para. 146 et seq. 
58 See above in section 5.2.4 on “take due account”. 
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Accordingly, the fact that a CSA provided comments, remarks, observations to the LSA in the course of 
the four-week period mentioned in Article 60(4) which are not clearly and unambiguously declared as 
arelevant and reasoned objection does not entail an obligation or the possibility for the LSA to submit 
a revised draft decision. It should be recalled in this respect that both the LSA and the other CSAs are 
bound by the draft decision in case no objections are submitted “in the period referred to in 
paragraphs 4 and 5” pursuant to Article 60(6). This means that the LSA is m issuing a revised draft 
decision if no objections are submitted formally by the CSA, via the EDPB information system, in the 
four-week period set forth in Article 60(4) (more details in section 8) °. 

Should the LSA consider it necessary to nevertheless adapt its draft decision as submitted under Article 
60(4) on account of factors or considerations supervening during the four-week period, including 
comments or remarks submitted by the other CSAs, or further submissions by the 
controller/processor, the LSA should withdraw its draft decision prior to the expiry of the four-week 
period and submit a new draft decision to the other CSAs. In doing so, the LSA should strike a balance 
between on one hand the importance of the factors or considerations supervening and on the other 
hand the need to ensure the expediency of the cooperation procedure™. In all cases, the LSA should 
make clear to all the CSAs why it is withdrawing its draft decision by referring to the specific factor or 
consideration that is prompting it to take such a step. A new four-week period will start once the new 
draft decision is submitted. As said, this option is barred after the expiry of the above period in the 
absence of reasoned and relevant objections and the draft decision as initially issued becomes binding 
on the LSA and the other CSAs. 


Considering the above, it is important for the LSA and the other CSAs to consult each other on how the 
LSA interprets the objections and how it intends to follow the objections. 


Regarding the manner of submitting the revised draft decision, the same considerations apply as to 
the submission of the draft decision by the LSA". A clear timestamp (date, hour) of the submission is 
the starting point for the two-week period referred to in Article 60(5)(2), therefore the revised draft 
decision shall only be submitted by way of the EDPB Information system. 


7.1.3. The submission of the revised draft decision 

As for the contents of the submission, the considerations made regarding the contents of the draft 
decision apply®. In short, the LSA is required to only submit a revised draft decision as such. The 
considerations made regarding the draft decision and the need to ensure compliance with the right to 
be heard®? apply mutatis mutandis to the revised draft decision as well, so that the LSA should make 
sure that the revised draft decision references the steps taken to ensure such compliance and is self- 
explanatory regarding the changes introduced to follow the RRO and the underlying reasons™. 


5° Comments signalling editorial errors and typos may however be taken into account to avoid material mistakes 
in the final decision. 

50 See the consideration regarding for instance the reasonable time for handling complaints mentioned in Recital 
129. 

51 See above in section 5.2.3 on Article 60(3)(2) on submission/timing. 

52 See above section 5.2.2 specifying the term draft decision. 

53 See above para. 105. 

64 See also para. 159 as for informal exchanges prior to submission of a revised draft decision. 
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Article 60(5)(1) does not set any specific deadline for the submission of the revised draft decision by 
the LSA. This is one of the instances where there is a flexibility given to the SAs by the GDPR, also in 
order to facilitate the endeavour to reach a consensus. However, the principle of good administration, 
including the principles of reasonable timeframe and procedural economy still applies. Further, some 
factors that should be taken into account by the LSA in this respect include the following: 


e the fact that a revised draft decision is subject to a shorter assessment period (2 weeks) 
compared to the draft decision; 


e the reference to “without delay” applying to the submission of the draft decision under Article 
60(3); 


e the consideration made in Section 5.2.4 on Article 60(3)(2) as to the need to take account in this 
regard of the complexity of the case at hand, and here in particular of the number and nature 
of the relevant and reasoned objections received by the LSA; 


e more generally, the obligation on all SAs to cooperate fairly and in a spirit of mutual trust. 


All the above considerations would point to the need for the LSA to make sure that the lapse of time 
between receipt of the relevant and reasoned objections under Article 60(3) and submission of the 
revised draft decision is as short as possible and appropriate to the context of the OSS procedure. This 
is without prejudice to the efforts made to reach consensus and to the eventual obligation of the LSA 
to provide the right to be heard again, pursuant to national law, in view of envisaged changes in the 
revised draft decision that will newly affect the rights of the controller or processor. 


7.1.4 The views of the other CSAs 

The purpose of the submission of a revised draft decision by the LSA is to allow all involved SAs to find 
consensus and to gather their opinions on the proposed revised draft decision. It is important to note, 
in this regard, that the purpose of Article 60(5) is to afford the CSAs the opportunity to express a view 
on any amendments / revisions that have been made to the original text of the draft decision that was 
originally circulated by the LSA pursuant to Article 60(4). The wording “for their opinion” of Article 
60(5)(1) mirrors, in this respect, the wording of Article 60(3)(2) (see above section 5.2.1). 


This means that — like for the draft decision — the submission of a revised draft decision should be 
preceded by exchanges between the LSA and all the CSAs to share the new conclusions the LSA has 
reached in the light of the relevant and reasoned objection(s) it intends to follow along with the 
relevant reasoning, in order to gather the opinions of the other CSAs®. This is especially appropriate if 
the relevant and reasoned objections address several issues in the case at hand, so that the extent and 
depth of the exchanges may vary from case to case. The LSA may for instance, where appropriate, 
share a preliminary revised draft decision before issuing the formal revised draft decision. 


In turn, this will enable the other CSAs to flag remaining issues or questions that the LSA may wish to 
address at this stage, again in an endeavour to reach consensus, prior to the formal submission of a 
revised draft decision. In particular, the other CSAs should clearly indicate the points in respect of 
which they consider that the relevant and reasoned objections have not in fact been taken on board 
(i.e. followed) by the LSA. Ultimately, this informal consultation stage is intended to prevent the 
opinions by other CSAs from turning into relevant and reasoned objections to the revised draft decision 


65 At this moment, the LSA should as well take account of the views of the other CSAs raised as comments. 
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and therefore from triggering the next steps in the procedure as outlined in the following section, with 
all the relevant consequences. 


7.2 The Revised Draft Decision: Assessment Procedure 

7.2.1 Joint application of Article 60(5) second sentence and the procedure of Article 60(4) 
Article 60(5)(2) sets forth the formal procedure applying to the examination of the revised draft 
decision by the other CSAs. This procedure is the one referred to in Article 60(4), with the difference 
that the timeline is limited to two weeks®. 


It should be noted that, by referencing Article 60(4), (5)(2) also regulates the procedure to be followed 
by the LSA in case it rejects or does not follow any relevant and reasoned objection to the revised draft 
decision as expressed by other CSAs in the two weeks following submission. This has several 
consequences: 


In both cases the only outcome envisaged according to the procedure provided for under Article 60(4) 
is the submission of the matter by the LSA to the consistency mechanism, i.e. to the EDPB (as described 
in Section 6.2.3) with a view to a binding decision settling the dispute, which the LSA and other CSAs 
are then required to abide by (under Article 65(2) and (6)). 


If no objections are raised by the other CSAs in the two-week period mentioned in Article 60(5)(2), 
Article 60(6) applies. Subsequently, the revised draft decision becomes binding on both the LSA and 
other CSAs, since Article 60(6) refers to the absent submission of relevant and reasoned objections 
within the periods referred to “in paragraphs 4 and 5”. 


Thus, if relevant and reasoned objections are raised in the two-week period and the LSA intends to 
follow them, the only alternative is to apply Article 60(5)(1) again, in order to ultimately achieve the 
agreement on the (revised) draft decision, as per Article 60(6), which will become then binding for 
both the LSA and other CSAs. 


This would be in line, on the one hand, with the endeavour to reach consensus, as prescribed by Article 
60(1), and on the other hand, it would prevent triggering Article 65(1)(a) when there is no dispute to 
be settled at this point. Indeed, Recital 138 clearly supports such an approach, in that all means within 
the cooperation mechanism should be exhausted before activating the consistency mechanism. 


Nevertheless, considering the enhanced cooperation procedures as outlined in this guidance (e.g. 
exchange of relevant information in different stages and informal consultation before submitting a 
draft decision), this situation should be very exceptional and limited to the cases where, despite all 
efforts, specific circumstances did not allow reaching a consensual position before. 


However, it shall be borne in mind by the other CSAs and the LSA that that the GDPR provides for a 
swift action and for the powers of the SAs to be exercised fairly and within a reasonable time, as 
mentioned in Recital 129. Actually, it can be argued that it was not the intention of the legislator to 
promote an indefinite loop of revised draft decisions. For that reason, the possible submission of new 
revised draft decisions should be of an extraordinary character, as necessary in the particular case to 
strive for final consensus. 


66 See above section 6.2.1 for Calculation of the deadline. 
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Recognising that the endeavour to reach consensus set forth as an overarching objective of the 
cooperation procedure in Article 60(1) does not entail an obligation to achieve consensus at all costs, 
when the LSA mindfully intends to follow a relevant and reasoned objection, and, by this way, achieve 
such goal, that should be made possible by submitting a (re-)revised draft decision. 


Where the LSA concludes that consensus is not possible, as there is no substantive convergence 
between the LSA and other CSA(s), either because there are contradictory views from CSAs or because 
some legal issues remain unsettled, the LSA is then obliged by Article 60(5)(2) to prompt the procedure 
provided for in Article 60(4) and, consequently, to refer the case to the EDPB for the dispute resolution 
procedure as per Article 65(1)(a). 


7.2.2 Constraints on other CSAs in submitting relevant and reasoned objections to the 
revised draft decision 

A further issue to be considered concerns the scope of the “procedure referred to in paragraph 4” as 

applied in the context of Article 60(5)(2). This refers in particular to whether specific legal constraints 

apply on either the CSAs or the scope of a relevant and reasoned objection to the revised draft decision 

issued by the LSA. 


It should be recalled that the LSA and other CSAs are bound by the (revised) draft decision under Article 
60(6) only if no objections have been submitted to the (revised) draft decision. If this is not the case, 
i.e. if relevant and reasoned objections were indeed raised to the draft decision pursuant to procedure 
provided for under Article 60(4), then no CSA is bound by the draft decision; moreover, the revised 
draft decision submitted by the LSA under Article 60(5)(1) is a different legal instrument compared to 
the draft decision mentioned in Article 60(4). Accordingly, a CSA may raise a relevant and reasoned 
objection to the revised draft decision even if it had not raised any objections to the draft decision 
during the four-week period mentioned in Article 60(4). 


Indeed, the changes introduced by the LSA to follow the relevant and reasoned objections may raise 
new questions and issues a CSA disagrees with in the context of the revised draft decision. As per the 
above guidance, the CSA should make sure that each relevant and reasoned objection it submits should 
“indicate each part of the draft decision [here: revised draft decision] that is considered deficient, 
erroneous or lacking some necessary elements, either by referring to specific articles/paragraphs or by 
other clear indications”*’. 

The EDPB strongly encourages the LSA to share in advance its intention to revise the draft decision not 
only to the CSA that has raised an objection but also to all other CSAs. This will ensure that the revised 
draft decision and the reasoning employed will not come as a surprise to the other CSAs, and will help 
in preventing their possible negative reaction on the proposed changes. 


The aim of a revised draft decision within the meaning of Article 60(5) is to endeavour to find consensus 
on issues for which no consensus was previously found. As a result, a CSA should not raise a relevant 
and reasoned objection in relation to a revised draft decision if there was previously no relevant and 
reasoned objection directed at that specific issue and the LSA has not revised the draft decision in 
respect of such issue. 


67 See EDPB Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679 para. 7. 
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8 THE BINDING EFFECT OF A (REVISED) DRAFT DECISION 


187. Article 60(6) describes the final step of the decision finding process in cases in which a consensus 
between the LSA and other CSAs could be reached. In this case, consensus is signalled by the absence 
of objections to the (revised) draft decision, which means that Article 60(6) is applicable. This has two 
legal consequences: 


e that the LSA and other CSA(s) are deemed to be in agreement, 
e that they are bound by the decision in the sense that the assessment process following the 
issuing of the draft decision came to an end. 


8.1 Deemed to be in agreement with the draft decision 

188. Firstly, Article 60(6) states that, in the absence of an objection, the SAs shall be deemed to be in 
agreement with the (revised) draft decision in its entirety. The term “deemed to be in agreement” 
clarifies that the CSAs do not have to explicitly endorse the (revised) draft decision. The GDPR provides 
for a tacit agreement and supposes that the SAs have successfully reached consensus in the 
cooperation procedure. This tacit agreement refers to the content of the (revised) draft decision. 


8.2 Bound by the draft decision 

189. Since the LSA and other CSAs are presumed to be in agreement, they shall be bound by the content of 
the (revised) draft decision. This has immediate binding effects for all involved SAs. This means, that 
any further adoption of a measure under national law, such as the dismissal of a complaint, has to be 
strictly in line with the agreed draft decision. 


190. Two different dimensions of the binding effect can be distinguished, i.e. as regards the entities bound 
by the (revised) draft decision (LSA/CSAs) and the scope of that (revised) draft decision. 


19 


ray 


. Firstly, both the LSA and other CSAs are bound by the (revised) draft decision because no objections 
were raised or maintained. The legal consequences of the binding effect are that in this case the 
(revised) draft decision cannot be changed further or withdrawn afterwards®. The decision to be 
adopted by the LSA (Article 60(7)) or by a CSA (Article 60(8)) or in a shared form by both SAs (Article 
60(9)) shall be based on the (revised) draft decision as it is. 


192. The decision only binds the LSA and the other CSAs that participated in the cooperation procedure. 
Only SAs which have participated in the cooperation procedure (i.e. which have formally confirmed 
their role as a CSA in the context of this Article 60 procedure), and had the opportunity to raise a 
relevant and reasoned objection against the draft decision can be bound by a decision which was taken 
in that procedure. The other SAs neither had the opportunity to present their views in the cooperation 
procedure nor could raise a relevant and reasoned objection against the draft decision. 


193. Therefore, if a CSA with a complaint which could be handled within the ongoing procedure asks the 
LSA to include its case in this procedure and join the cooperation procedure prior to the submission of 
the draft decision and had the opportunity to raise a relevant and reasoned objection, the procedure 


68 In certain exceptional cases provided for by law such changes or withdrawal might still be necessary; see para. 
207. 
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can continue and the “new” CSA will be bound by the draft decision provided that the requirements 
of Article 60(6) are met. 


Conversely, if a CSA with a complaint which could be handled in the ongoing cooperation procedure 
only sends its case to the LSA to be bundled with the other(s) after the deadline of Article 60(4) or 
Article 60(5) has expired (e.g. because a SA received a complaint referring to the same infringement 
after the expiry of the deadlines), and, therefore, had not had the opportunity to express a relevant 
and reasoned objection, this CSA should very carefully consider whether a new cooperation procedure 
should rather be triggered for that purpose, as by requesting the LSA to bundle the new case within 
the ongoing procedure at this stage, this CSA is de facto waiving its possibility to raise an objection to 
the decision®. 


The EDPB considers that, in principle, the LSA is not required to continuously check that all possible 
relevant CSAs with cases, which could be bundled to the ongoing procedures being dealt with, are 
informed about the ongoing cooperation procedure. 


The binding effect granted by Article 60(6) to the specific decision is thus strictly limited to the specific 
cooperation procedure. The cooperation procedure deals with a specific issue and aims to reach 
consensus regarding the specific case. 


Therefore, besides the binding effect of the decision as per Article 60(6), the outcome of a given 
cooperation procedure may not be automatically extended to other cooperation procedures, in spite 
of possible similarities. However, according to Article 51(2), each SA shall contribute to the consistent 
application of the GDPR and therefore, the LSA may reuse the text and conclusions of a draft decision 
agreed upon in a previous cooperation procedure involving the same or different controller and the 
same infringement of the GDPR to speed up the procedure at hand if it considers that this can facilitate 
reaching an agreement also in the current case. 


The EDPB considers that the binding effect under Article 60(6) of a specific decision cannot cover the 
clarification of abstract legal questions, which are not connected to the real case. A SA that intends to 
ask the EDPB for clarification of abstract legal questions should instead consider the Article 64(2) 
procedure if the question refers to a matter of general application or producing effects in more than 
one MS. 


9 ARTICLE 60(7) — THE LSA ADOPTING AND NOTIFYING THE 
DECISION 


9.1 General 
Article 60(7-9) address the different scenarios after the LSA and other CSAs have been bound by the 
draft decision. These steps can be reached after: 


(i) either the procedure laid down in the previous chapter has been concluded and consensus 
has been reached, or 
(ii) after a dispute resolution by the Board has been concluded. 


59 See above para. 22 et seq. 
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The abovementioned paragraphs outline: 


(i) which SA shall adopt a final decision following the previous steps, and 
(ii) which SA notifies or informs the controller, processor and complainant respectively. 


Article 60(7) provides the procedure to follow in case a decision targeted at the controller or processor 
is to be adopted by the LSA. Article 60(8) and (9) are only relevant in complaint-based cases. Article 
60(8) regulates the cases where the decision dismisses or rejects the complaint and should be adopted 
by the complaint receiving SA(s)”°. Finally, Article 60(9) clarifies the procedure to be followed where 
some parts of a complaint have been dismissed or rejected, and the respective decision is adopted 
towards the complainant by the complaint receiving SA, while other parts have been acted upon, 
leading to a decision towards a controller or processor by the LSA. 


Due to this relation, many of the concepts and considerations related to Article 60(7) will be 
analogously applicable for Article 60(8) and (9). 


9.2 Adoption of the final decision by the LSA 
Article 60(7)(1) stipulates that the LSA will be required to adopt a decision. This adoption is either: 


= the implementation by way of a national decision of the consensus reached under Article 
60(6), and/or 

= the implementation by way of a national decision on the basis of the binding decision of the 
EDPB adopted under Article 65, following the procedure provided under Article 65(6). 


In either case, the national decision needs to give full effect to the binding consensus reached under 
Article 60(6), and/or to the binding directions set out in the EDPB’s decision under Article 6577. 


At the same time, the LSA will need to adjust the format to comply with its national administrative 
rules. Lastly, it will be able to make purely editorial changes before adopting its national decision”. 


Article 60(7) does not stipulate a concrete timeframe within which this adoption has to take place. 
Nonetheless, the adoption should take place as swiftly as possible, in line with the principle of good 
administration. In contrast, if this point was reached following a consistency procedure, the deadline 
of one month provided by Article 65(6) has to be followed. 


However, there could be exceptional situations, where adopting a decision, which is implementing the 
conclusions to which the SAs are bound under Article 60(6) would affect the legality of the national 
decision. This may be due to a ruling by the CJEU with an interpretation different to which the other 
CSAs and the LSA are bound or a change in legislation. In case of such circumstances, the CSA who 
becomes aware of those new facts should immediately inform the LSA and vice versa. Following this, 
the LSA should inform the other CSAs accordingly and submit to the other CSAs a new draft decision 


70 Article 60 gives the CSA(s) that have received a complaint, which is subject to the procedure, a special role. 
This is further elaborated in the part on Article 60(8) and Article 60(9). To avoid confusion between these SAs 
and other CSAs, the term complaint receiving SA is used. It is important to note that even the LSA can have the 
role of a complaint receiving SA. 

71 See para. 114 and para. 192. See also para. 50 of EDPB Guidelines 03/2021 on the application of Article 65(1)(a) 
GDPR - version for public consultation. 

72 See footnote 58. 
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that takes account of the changed circumstances. This new draft decision should be aligned as much 
as possible with the previous draft decision, to make use of the already found consensus. 


9.3 Notification and information 

Once the decision has been adopted, the LSA shall notify the decision to its addressee(s). In complaint- 
based cases, the complaint receiving SA(s) shall also inform the complainant(s) of the decision. While 
the terms “notify” and “inform” are not specified in the GDPR, they may be specified in national law. 
However, the CJEU clarified that the duty to notify is satisfied when the addressee is placed in a 
position in which it can effectively become aware of the existence of the decision and the reasons why 
the institution intends to justify it”’. 


In line with the above, Article 60(7-9) appears to give the term “notify” a more formal value, as it is 
used for the communication to the party that may suffer adverse effects by the decision, and therefore 
may intend to challenge it”*. 


Therefore, for Article 60(7-9), when notifying the decision to the addressee, the SA should provide a 
full copy of the decision in a language complying with its national laws. Additionally, the MS in which 
the decision was notified will be the MS in which the decision may be challenged and, as outlined 
below, it should be brought to the attention of the parties that were merely informed that judicial 
action should be sought in such MS. 


In any case, in the context of Article 60(7), after the LSA has notified the decision” to the main or single 
establishment of the controller or processor, as the case may be, it shall inform the other CSAs and the 
Board of the decision in question, including the information specified in the subsection below. For this 
purpose, the SA should make use of the Article 60 Final Decision notification procedure in the EDPB 
information system. 


Besides ensuring transparency towards the CSAs, providing this information to the Board is essential 
to allow the SAs to comply with their obligation to contribute to the consistent application of the GDPR 
as stipulated in Article 51(2). This will allow them to avoid an inconsistent application of the GDPR 
should they in the future need to handle a similar case. 


The complaint receiving SA(s) is then required to inform the complainant of the outcome of the 
complaint, in accordance with its national laws and/or practices. Additionally, the complaint receiving 
SA(s) should inform their complainant(s) pursuant to Article 77(2) that they may seek judicial remedy 
before a court in the MS of the LSA, if they are concerned by the decision of the LSA in the meaning of 
Article 78(1)”°. 





Example 9: After a media report casting doubt about the lawfulness of the processing conducted by 
HappyCompany, multiple individuals file a complaint with their local SA. Once the LSA has been 
identified, it decides to handle the complaints, as they refer to the same processing activity and the 
same infringement, in one file. Following the adoption of a decision by the LSA and the notification of 


73 See for more C-6/72 Section 15 p.2, joint cases T-121/96 and T-151/96, p. 40, joint cases C-115, 116/81 p. 13 
74 See also para. 55 of EDPB Guidelines 03/2021 on the application of Article 65(1)(a) GDPR, Article 78 and Recital 
(143) GDPR. 

75 See also section 5.2.2 on the term of “draft decision” for formal requirements. 

76 The complaint receiving SA should be able to identify the relevant court based on the adopted decision shared 
by the LSA. 
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decision. When doing so, the complaint receiving SAs also inform their complainants that they can 
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At this moment, the LSA should as well inform the controller or processor of its obligations under 
Article 60(10) and the possible consequences of non-compliance. 


9,4 A summary of the relevant facts and grounds 

When the LSA informs the other CSA(s) and the Board, it provides a summary” of the relevant facts 
and grounds regarding the decision in question. This summary should include the formal steps and 
grounds, as well as the substance, of the decision. 


Therefore, the summary should include, at least, the following information”®: 


e The date of the final decision; 

e The identification of the LSA and other CSAs; 

e The name of the controller(s) and/or processor(s); 

e The relevant legal conclusions in question (infringed provisions/rights not granted’), in 
relation to the factual basis of the case®°: 

e The outcome of the procedure and, if applicable, the corrective measures taken*®. 


As the case may be, the summary should allow any Member of the Board to understand the subject 
matter and conclusion of the decision reached. It is recommended that the LSA also provide a copy of 
the decision in English. This should be done by making use of the appropriate fields in the EDPB 
information system. 


10 ARTICLE 60(8) -THE DISMISSAL/REJECTION OF A COMPLAINT 


Article 60(8) concerns the situation where the CSAs including the LSA have agreed to dismiss or reject 
a complaint in full, or where this was concluded by the EDPB following Article 65. The SA with which 
the complaint was lodged can be either the LSA or another CSA. It introduces three obligations on the 
SA with which the complaint was lodged: 


° to adopt the decision, 
° to notify it to the complainant, 
° to inform the controller. 


This is to be done by derogation from Article 60(7). 


77 This is separate from a summary of the decision. 

78 This information is contained in the fields that are to be filled out in the “final decision” form in the EDPB 
Information system. 

7? This could be due to restrictions under Article 23. 

80 See for instance the fields “Description of the Cooperation Case” and “GDPR Legal reference”. 

51 See for instance “Kind of Decision”. 
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10.1 Derogation from paragraph 7 

Article 60(8) introduces a derogation from the situation where the LSA adopts and notifies the decision 
to the main, or single, establishment of the controller or processor in the EU. It applies solely in the 
situation where a complaint is dismissed or rejected in full. 


Although in general, in the OSS mechanism, the LSA should remain the sole interlocutor of the 
controller/processor for their cross-border processing, in this specific situation a CSA has to inform the 
controller/processor about the dismissal or rejection of the case. 


10.2 The term “Dismissal/Rejection” 

The concepts of dismissal and rejection may have different definitions at national level, and therefore 
also different procedural/administrative implications. However, the GDPR does always refer to both 
actions, a dismissal or a rejection®. 


The CJEU has consistently held that the terms of a provision of EU law which makes no express 
reference to the law of the MS for the purpose of determining its meaning and scope must normally 
be given an autonomous and uniform interpretation throughout the EU, having regard not only to its 
wording but also to the context of the provision and the objective pursued by the legislation in 
question. This follows from the need for uniform application of EU law and from the principle of 
equality’. 


Regarding more specifically the interpretation to be given of what dismissal/rejection entails, 
reference can be made to the wording of Article 60(9) where dismissal/rejection are contrasted with 
a decision to “act on” the complaint. It should be noted that Article 60(9) refers to the LSA adopting 
the decision “for the part concerning actions in relation to the controller”, in which case the decision 
will be notified by the LSA to the controller/processor, whilst it refers to the CSA adopting the decision 
“for the part concerning dismissal or rejection of that complaint”, in which case the decision will be 
notified by the complaint-receiving SA to the complainant. Thus, Article 60(9) read jointly with Article 
60(8) can be interpreted in the sense that dismissal/rejection of a complaint as the outcome of an 
Article 60 procedure entails that the (part of the) final decision to be adopted does not contain any 
action to be taken in relation to the controller. 


From this standpoint, such a decision can be considered to adversely affect the complainant. This is 
confirmed by the GDPR legislative process, where a more general reference to decisions “adverse” to 
complainant was madeĉ*. The explicit reference to the right to judicial remedy and proximity to the 
complainant (as recalled above in particular in paragraph 213) also suggests that adverse decisions for 
the complainants should fall within this category. When the complaint is not followed at any level in 
the final decision and the LSA does not take any action in relation to the controller/processor in that 


82 The CSAs will have agreed beforehand on the substantive consequences of the decision. The implementation 
of the consequences has to be done in line with national law, e.g. via a rejection or via a dismissal. 

8 See e.g. Case C-617/15, Hummel Holding, para. 22 and case law cited therein. 

84 See https://data.consilium.europa.eu/doc/document/ST-14788-2014-REV-1/en/pdf. In this version, the 
provision read: “Where the decision jointly agreed upon concerns a complaint and as far as it adversely affects 
the complainant, notably where the complaint is rejected, dismissed or granted only in part, each supervisory 
authority that have received such complaint shall adopt the single decision concerning that complaint and se rve 
it on the complainant.” p. 36. 
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decision, the controller/processor will not have an interest in a judicial remedy within the MS of its 
main establishment. The complainant on the other hand, will have an interest in challenging the 
decisions adversely affecting him/her within their own MS, and in their own language®. 


Thus, a decision dismissing or rejecting a complaint (or parts of it) should be construed as a situation 
where the LSA has found, in handling the complaint, that there is no cause of action regarding the 
complainant's claim, and no action is taken in relation to the controller. In such case, the complaint 
has to be dismissed or rejected via the decision adopted by the complaint receiving SA, as the case 
may be®®, 


Notification received in application of Article 60(8) can be used by the complainant to exercise the 
right to judicial remedy against the decision taken by a SA. Because this decision has to be adopted by 
the complaint receiving SA, this will allow proximity of the complainant to the competent court, under 
Article 78(3) and under Article 47 of the Fundamental Rights Charter (by seizing a court in the 
complainant’s MS as the decision will be adopted by the CSA in that MS)®”. 


This means that, for the purpose of the application of Article 60(8) and (9), and of the final sentence 
of Article 60(7), the decision that is the outcome of the cooperation procedure should clearly provide 
for the dismissal or rejection of the complaint, or for the action to be taken in relation to the controller 
by the LSA, so that the LSA and CSA can direct the subsequent adoption of the respective national 
decisions accordingly, in pursuance of Article 60(8), (9) or (7). 


If provided in national law, SAs should rely on these definitions of dismissal/rejection, as well as in the 
national administrative practices that configure a case of dismissal/rejection of a complaint, and 
proceed, in such cases accordingly®®. In any case, the draft decision, shared as indicated in the previous 
sections, should provide clear reasoning as to why the complaint is dismissed/rejected under the 
relevant national laws. 


It is important to note that a dismissal or rejection at this stage is different from a possible finding of 
dismissal or rejection at the vetting stage of the complaint procedure. As highlighted in paragraph 50, 
this vetting precedes any submission of the complaint to the LSA and is performed by the complaint 
receiving SA. In such a case, the complaint would be dismissed or rejected before reaching the 
cooperation stage. 


It should also be acknowledged that there may be situations where the interests of the data subject 
are not adversely affected by the outcome of the OSS procedure, on account of the steps taken by the 
LSA in the course of handling the complaint. In such cases, the key factor is the demonstrated removal 


85 See also the A.G. Opinion in case C-645/19 Facebook. In para. 105 the Opinion states: 

“These mechanisms of shifting the competence to adopt the decisions and, where necessary, of potentially 
adopting two-tier decisions (the LSA vis-à-vis the controller or processor, and the local authority vis-à-vis the 
complainant) seem specifically intended to avoid data subjects having to ‘tour’ the courtrooms of the European 
Union in order to bring proceedings against inactive supervisory authorities.” 

86 Possibly in conformity with the applicable national provisions where they do define the precise scope of 
dismissal/rejection. 

87 See Recital 141: “the right to an effective judicial remedy in accordance with Article 47 of the Charter (...) 
where the supervisory authority partially or wholly rejects or dismisses a complaint (...)”. 

88 The SAs should make sure that the application of such definitions is consistent with the understanding of the 
terms as set out in this section. 


Adopted 42 


231. 


232. 


233. 


234. 


235. 


of the cause of action - that is to say the complainant obtained the vindication of his/her rights through 
the intervention of the LSA towards the controller, which meanwhile met the terms of the 
complainant’s claim. In such cases, providing that the complainant has been informed in the course of 
the procedure about the favourable result achieved, the LSA may decide to no longer take action in 
relation to the controller — i.e. none of the factors mentioned above in respect of dismissal/rejection 
vs. taking action is applicable. 


This is the case, in particular, with the amicable settlement situation - i.e. the situation where the case 
has been resolved to a satisfaction of a data subject, when the infringement alleged in the complaint 
has been identified by the LSA and when the complainant agreed to an amicable resolution of this 
complaint. This situation falls within the remit of Article 60(7). Indeed, as already pointed out, the 
decision does not adversely affect the complainant, who manifested his or her satisfaction with the 
proposed settlement, and as such is not to be adopted by the complaint receiving SA under Article 
60(8) or (9) — there being no dismissal or rejection at play. It will be for the LSA to adopt the final 
decision in such a case®’, to take stock of the achieved settlement in its capacity as the sole interlocutor 
of the controller/processor under Article 56(6). 


This also applies to cases that do not fall within the amicable settlement constellation, as the LSA did 
not or could not attempt such a settlement, but, nevertheless, its intervention during the handling of 
the complaint led the controller to stop the infringement and fully satisfy the complainant’s claim. In 
view of this result and of the specific circumstances of the case, the LSA may consider that the most 
adequate decision for the complaint at hand is to terminate the handling of the case, taking note of 
the achieved solution, and without taking any action towards the controller”. 


However, since an infringement was indeed identified by the LSA, the decision not to take any action 
towards the controller would have to be based on the careful assessment of the circumstances of the 
complaint as a whole, in order to keep the same level of guarantees afforded to the data subjects. 


On the other hand, within this context the final decision will not be issued by the complaint receiving 
SA but instead by the LSA, as per paragraph (7), even though no action is to be taken in relation to the 
controller through such final decision — in recognition of the LSA’s role as the sole interlocutor of the 
controller targeted by the complaint at issue and the fact that a finding of an infringement can have 
an adverse effect on the controller. This would render it impossible for the complainant to challenge 
the decision in the MS where the complaint was lodged, regardless of whether the complainant still 
has or has not cause of action to seek judicial remedy against a SA. That is a matter for the courts to 
determine in the concrete case. Therefore, whenever this scenario may happen, it should be ensured 
by the LSA via the complaint receiving SA that the complainant is duly informed on the positive 
achievement and on the envisaged outcome of the complaint and expresses no disagreement. 


Lastly, it should be recalled that also the decision not to take action towards the controller, even when 
an infringement took place, has to have been agreed by the LSA and other CSAs, which entails that all 


89 As this is the general rule, see also ECJ Case C-645/19 para. 56: "In accordance with Article 60(7) of that 
regulation, it is the responsibility of the lead supervisory authority, as a general rule, to adopt a decision with 
respect to the cross-border processing concerned...” 

9° This is without prejudice to the assessment on what is “the extent appropriate” to which the complaint is to 
be investigated pursuant to Article 57(1)(f), for which discretion lies with the SAs. 
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the circumstances of the case were duly taken into account, including the guarantee of the rights and 
freedoms of the complainant. 








Example 10: Unhappy customer submits a complaint to its local SA in MS A. The SA performs the 
preliminary vetting and forwards the complaint to the LSA. After receiving the complaint, and, upon 
investigating the issue, the LSA cannot find evidence to support the complaint. Therefore, the LSA is 
unable to determine the infringement and concludes that the complaint is to be rejected/dismissed, 
as no action is taken on the controller. The LSA shares a draft decision to that effect and as no objection 
is raised, pursuant to Article 60(8) the complaint receiving SA will adopt the final national decision 
rejecting/dismissing the complaint and notify it to the complainant. 


Example 11: A complainant indicates he sent a request to a controller and did not receive any answer. 
The DPA does not receive any response to its preliminary vetting actions. The complaint receiving SA 
sends the case to the LSA. The LSA notes that the request was sent to a wrong/non-existent address 
by comparison to what is indicated on the website of the controller (the complainant seems to have 
tried a contact@XXX.com address without checking the contact addresses mentioned on the website). 
The LSA shares a draft decision whereby the complaint is to be dismissed/rejected since there was only 
a mistake made by the complainant. As no objection is raised, the complaint receiving SA adopts the 
final dismissal/rejection decision under Article 60(8) and notifies it to the complainant. 


Example 12: Unhappy customer submits a complaint to its local SA in MS A, arguing that the website 
HappyCompany is infringing its rights. After performing the preliminary vetting the complaint is 
transferred to the LSA in MS B. The LSA starts an investigation but cannot access the website in 
question. After some further research, it finds that in the meantime the controller has been dissolved. 
Therefore, the investigation cannot be continued and the LSA cannot find sufficient evidence to 
support the claims of the complainant. The LSA shares a draft decision that the complaint should be 
dismissed as the cause of the complaint has disappeared. As no objection is raised, the complaint 
receiving SA adopts the final national decision dismissing/rejecting the complaint under Article 60(8), 
and notifies it to the complainant. 


Example 13: Unhappy customer submits a complaint to its local SA, arguing that her data are kept and 
processed unlawfully by HappyCompany, which is infringing her rights. After performing the 
preliminary vetting the complaint is transferred to the LSA. The LSA starts an investigation and is 
informed by controller that indeed the complainant’s data are kept in their files on account of a failure 
in their customer resource management that did not erase the information in due time (preferences, 
purchase history, etc.); however, they immediately erased the information following the letter sent by 
the LSA, and proof of this is provided to the LSA. Therefore, the LSA shares a draft decision where it 
finds an infringement by the controller and it represents the situation as remedied following the LSA’s 
intervention, without proposing any corrective measures in respect of the controller in particular 
because this was the first time such an infringement was committed. Accordingly, the LSA proposes to 
go for the option of adopting the final decision itself under Article 60(7). As no objection is raised, the 
LSA adopts a final national decision along the said lines and notifies it to the controller, whilst the 
complaint-receiving SA will inform the complainant of such decision. 





236. 


10.3 Adoption of the decision 

The SA that is required to adopt the decision is the SA, which received the complaint(s). This could 
apply to multiple SAs. It should do so in the way required under its national legislation. Even in the 
case where the complaint receiving SA is the LSA, its decision needs to be adopted under the procedure 
of paragraph 8 as derogation from paragraph 7 (lex specialis rule). Therefore, the complaint receiving 
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SA adopting the decision may be either the LSA, another CSA, or both (or all), depending on the number 
and nature of complaint(s). 


When the complaint is lodged with one, or more CSAs, the LSA shall prepare the draft decision 
dismissing/rejecting the complaint(s), and the CSAs shall issue a final decision in the EDPB Information 
System, adopting it also at national level and introducing the necessary national legal provisions. 


The CSA, when issuing a decision, must give full effect to the draft decision, which is binding on LSA 
and other CSAs under Article 60(6) and/or the EDPB binding decision following Article 65(1)(a)*". 


10.4 Inform and notify 

Once the decision has been adopted, the complaint receiving SA(s) shall notify the complainant and 
inform the controller/processor®. This is to be done by each complaint receiving SA(s) according to 
their own national laws and practices and in the language provided by these provisions. For this 
purpose, the complaint receiving SA(s) may rely on the assistance of the LSA to inform the 
controller/processor on its behalf. In any case, the complaint receiving SA(s) needs to inform both the 
complainant and the controller about their possibility to seek judicial remedy in its MS. 


The complaint receiving SA should then inform the other CSAs and the Board, including a summary of 
the relevant facts and grounds, as explained in section 9.4. This is grounded in the rationale of the 
information obligation mentioned in Article 60(7) regarding the decision adopted by the LSA, which is 
to ensure consistency by informing the other CSAs and the Board as a whole. The exchange of 
information on the actual decision finally adopted at national level — regardless of the SA that adopts 
such final national decision - is meant to ensure mutual knowledge of national decisions and avoid the 
arising of inconsistencies in the implementation of EU law. Thus, it would appear that although Article 
60(8) does not explicitly require the CSA to provide a summary of the relevant facts and grounds, this 
is an overarching requirement that is intended to ensure consistent enforcement of the GDPR. 


11 ARTICLE 60(9) — PARTIAL DISMISSAL/REJECTION 


. Article 60(9) is mainly a procedural step of the Article 60 procedure, which applies once the involved 


SAs have agreed on, and are bound by, a draft decision that contains both parts that were acted upon, 
and parts that were rejected/dismissed”’. 


In practice, this means that, at this point of the procedure, the decision on partial dismissal/rejection 
will have already been taken, and the parts in the draft decision that relate to the dismissal/rejection 
and those that refer to further action by the LSA have been clearly marked in the draft decision. SAs 
now only need to formalise it through the necessary adoption procedures described in Article 60(9). 
This gives rise to final national decisions, which must give full effect to the draft decision, which is 
binding on all CSAs under Article 60(6) and/or the EDPB binding decision following Article 65(1)(a). 


Accordingly, the related notification/information duties are split between the LSA and the complaint 
receiving SAs. The LSA adopts a decision for the parts of the complaint that were neither dismissed nor 


°1 The scope of possible changes is outlined in para. 207. 
52 See section 10.4 on the difference between notifying and informing. 
33 See section 10.2 The meaning of these concepts is the same for both para. 
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rejected in line with what has been set forth in section 10.2. The LSA notifies its decision to the 
controller and informs the complainant about it; in this regard, the EDPB considers that the LSA may 
rely on the complaint receiving SA(s) to convey such information to the complainant(s) for the sake of 
administrative efficiency. Each complaint receiving SA(s) adopts a decision for the parts that were 
rejected/dismissed concerning the complaint that was submitted to it, following the approach laid out 
in the previous section (see, in particular, paragraph 239). 








Example 14: Unhappy customer submits a complaint to its local SA, arguing that her data are kept and 
processed unlawfully by HappyCompany, which is infringing her rights. After performing the 
preliminary vetting the complaint is transferred to the LSA. The LSA starts an investigation and is 
informed by controller that indeed the complainant’s data are kept in their files on account of a failure 
in their customer resource management that did not erase the unnecessary information in due time 
(preferences, purchase history, etc.). However, certain complainant’s data have to be stored for longer 
because of financial and taxation requirements; proof of this is provided to the LSA. Therefore, the LSA 
shares a draft decision where it acts on parts of the complaint ordering the controller to finally erase 
the unnecessary information, and imposing a reprimand on the controller, but acknowledging the 
controller’s right to keep the remaining personal data as required by law and the need for the 
complaint receiving SA to reject that part of the complaint. As no objection is raised, the LSA adopts a 
final national decision ordering the controller to comply with the complainant’s request as for erasing 
the unnecessary information, notifies it to the controller and informs the complainant thereof; the 
complaint receiving SA adopts a final national decision rejecting the complaint as for the request to 
erase the necessary information and notifies it to the complainant, informing the controller thereof. 
The LSA and CSA will provide a summary of the relevant facts and grounds to the other SAs and the 
Board via the EDPB Information System, each of them for the respective final national decisions. 
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12 ARTICLE 60(10) — NOTIFICATION OF THE MEASURES ADOPTED BY 
THE CONTROLLER OR PROCESSOR TO THE LSA/CSA(S) 


Paragraph (10) addresses the situation that occurs within the OSS mechanism and after a notification 
to the controller or processor of a decision adopted against it is made by the LSA requiring the 
controller or processor to act on the complaint. 


This decision is notified as per either Article 60(7) or (9), when the LSA acts only on some of the 
grievances included in the complaint against the controller or processor. 


The first sentence of Article 60(10) includes the obligation on the controller or processor to adopt the 
necessary measures to guarantee compliance with the decision, which applies the corrective powers 
granted in Article 58(2). 


The controller or processor is obliged to ensure that these measures are implemented by all of its 
establishments in the EEA, where the processing at issue takes place. 


The Article 60(10)(2) includes a second obligation for the controller or processor, i.e. to notify the LSA 
of any measures it has adopted to comply with the decision, where the latter entailed corrective 
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measures. This obligation ensures the effectiveness of the enforcement. It is also the basis of possible 
necessary follow-up actions to be commenced by the LSA, also in cooperation with the other CSAs”. 


The second sentence of Article 60(10) also includes an obligation for the LSA to inform the other CSAs 
of the measures adopted by the controller or processor to comply with the decision taken against it. 
Although there is no set deadline for the LSA to provide such information to the other CSAs, such 
information should be disclosed as soon as the LSA receives the information from the controller or 
processor. 


When informing the other CSAs, the LSA should consider providing as well its assessment if it concludes 
that the measures taken are insufficient, in particular in order to decide whether further actions are 
necessary. 


13. ARTICLE 60(11) = URGENCY PROCEDURE 


Article 60(11) addresses the “exceptional circumstances” under which a SA may rely on the urgency 
procedure of Article 66 in the course of an Article 60 procedure. 


For the purposes of these Guidelines, the focus will accordingly be mainly on the wording of Article 
60(11), i.e. on the conditions for invoking Article 66 in the course of an OSS procedure, and on the 
consequences, this has on the ongoing OSS procedure. 


13.1 The conditions for invoking Article 66 
The following cumulative conditions must be fulfilled for a SA to invoke the urgency procedure under 
Article 66 pursuant to Article 60(11): 


e The SA is a supervisory authority concerned; 

e There are exceptional circumstances; 

e The CSA considers that there is an urgent need to act; and 

e Such urgency aims at protecting the interests of data subjects. 


Explanations on each condition are provided below. 


Article 60(11) refers to the CSA as part of an Article 60 procedure, i.e. to a CSA that participates in an 
OSS procedure®. Such a CSA may invoke Article 66 if all the applicable conditions are fulfilled. Since 
the LSA is also a CSA according to the definition in Article 4(22), in principle an LSA may also invoke 
Article 60(11) if all the other conditions are fulfilled. 


On the concept of “exceptional circumstances”, they could exist in situations where the urgency of the 
situation at hand is such as not to enable the use of the ‘standard’ cooperation or consistency 
procedures in a timeframe that is fitting. The exceptional nature of such circumstances dictates a 
restrictive interpretation. This applies in particular if, in spite of an ongoing Article 60 procedure, the 
CSA intends to request the EDPB, in accordance with Article 60(11), to adopt an urgent opinion or an 


%4 See section 4. 
°5 See para. 22 et seq. 
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urgent binding decision under the terms of Article 66(3) —i.e. when it is considered that a competent 
SA (most likely the LSA as such) “has not taken an appropriate measure”. All attempts by an SA to 
informally obtain an intervention from the competent SA should be made beforehand, and this is 
clearly also in line with the consensus objective underlying the whole Article 60 procedure. 


On the “urgent need to act and the criteria to be applied by the CSA to assess urgency under the 
specific circumstances, reference can be made to Recital 137, which states that this is in particular the 
case “when the danger exists that the enforcement of a right of a data subject could be considerably 
impeded”. According to European case law, it is not necessary for the imminence of the harm to be 
demonstrated with absolute certainty: it is sufficient to show that the damage is foreseeable with a 
sufficient degree of probability”®. 


On the fourth condition, it should be pointed out that Article 60(11) does not refer to “the rights and 
freedoms of data subjects”, contrary to Article 66, but more broadly to their “interests”. However, 
since the procedure to be applied is the one “referred to in Article 66”, the EDPB considers that such 
interests do coincide with the rights and freedoms of data subjects as per Article 66. 


As mentioned above, these conditions are cumulative and it is the responsibility of the CSA to provide 
“reasons” for each of them, regardless of whether it intends to take urgent measures under Article 
66(1) or request an urgent opinion or an urgent binding decision from the EDPB under Article 66(2) or 


(3). 


Furthermore, a CSA should consider several additional factors on top of the conditions set forth in 
Article 60(11) prior to taking such a step e.g.: 


° the elements gathered from the OSS procedure, 
° exchanges with the other CSAs (including the LSA), 
° exchanges with the controller/processor and, where applicable, the complainant regarding the 


cross-border processing at issue, 

° the stage reached within the Article 60 procedure (in particular, how close the procedure is to 
its finalization, and therefore to the taking of enforcement action regarding the 
controller/processor). 


Concerning the “urgent need to act”, the CSA should in particular take account of the last point. 


13.2 The interaction with an ongoing Article 60 cooperation procedure 

The urgency procedure under Article 66 derogates from the Article 60 procedure due to its exceptional 
nature; however, it leaves it unprejudiced. Thus, if a CSA relies on an urgency procedure in accordance 
with Article 60(11), and all the relevant conditions are fulfilled, it does not have the effect of 
terminating the existing OSS procedure. Therefore, the consequences resulting from the adoption of 
provisional measures by the CSA under Article 66(1)), and/or of an urgent opinion or binding decision 
requested by the EDPB under Article 66(2) or (3), will have to be factored in that OSS procedure 
accordingly. 


36 See order in Case T-346/06 R IMS v Commission [2007] ECR Il-1781, paragraphs 121 and 123. 
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From a general standpoint, a distinction can be drawn depending on the nature of the urgent measures 
sought: 


e the CSA adopted measures that are provisional and limited in time and to its national territory 


pursuant to Article 66(1) and does not intend to request final measures to the EDPB; 


e the CSA adopted provisional measures under Article 66(1) and intends to obtain final measures via 


the application of Article 66(2), or the CSA intends to directly obtain final measures via the 
application of Article 66(3); 


In the case of application of Article 66(1), the OSS procedure can continue towards the adoption of 
final measures under the LSA’s direction, without the CSA’s provisional measures having any particular 
consequences on the OSS procedure. In the scenario where Article 66(2) or (3) is applied, the urgent 
measures requested to the EDPB by the CSA are final in nature. Hence, in such scenario, the urgent 
binding decision or urgent opinion adopted by the EDPB is bound to impact the ongoing OSS 
procedure, in particular on account of the need for the LSA to implement it without delay. Accordingly, 
the LSA and other CSAs will have to suspend the handling of the case pending the issuance of such 
urgent binding decision or urgent opinion. 


Once the EDPB issues its urgent opinion or urgent binding decision, the OSS procedure can 
recommence and the effects produced by the urgency procedure will have to be factored in the OSS 
procedure. However, it should be considered that the LSA is required to adopt its final decision in 
pursuance of such EDPB urgent opinion or urgent binding decision within a very limited timeframe set 
by the EDPB on case-by-case basis (e.g. two weeks or one month), exactly on account of the urgency 
of the matter as endorsed by the EDPB. 


The LSA and the other CSAs are in the best position to establish whether the issues addressed by the 
ongoing OSS procedure have been fully covered by the LSA’s final decision adopted on the basis of the 
EDPB’s urgent binding decision or urgent opinion, or if there are outstanding issues. 


In the former case, the OSS procedure will come to its conclusion following the adoption of the final 
decision by the LSA, which will be followed by the procedural steps regulated under the terms of Article 
60(7-9) as the case may be. This may mean that, since the matter is closed, no draft decision will be 
shared by the LSA in accordance with Article 60(3)%’. If there are further issues that need to be 
addressed on top of those that have been the subject of the urgent opinion or urgent binding decision, 
the LSA will have to clearly identify which issues part of its draft decision remain to be addressed within 
the current OSS procedure and which ones were resolved via the urgent binding decision or urgent 
opinion adopted by the EDPB. In such a case, the current Article 60 procedure will resume after the 
LSA adopted and notified its final decision, from the stage at which it was suspended because of the 
urgency procedure. 


97 In any case, the views of the other CSAs were already expressed via the urgent binding decision or urgent 
opinion adopted by the EDPB. 
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QUICK REFERENCE GUIDE 


I. INTRODUCTION 


This annex is based on the GDPR and the Article 60 guidelines of the EDPB and should be read with the relevant sections of them for any question of legal 
interpretation. 


This document is meant to provide quick reference information on the procedures relating to the Cooperation between the lead Supervisory Authority (LSA) 
and the other Supervisory Authorities concerned (CSA) in case of cross border processing. Accordingly, the document is structured in accordance with the 
sequence of the steps to be performed in an Article 60 procedure by highlighting both legal obligations and shared best practices as set out in the said GDL. 


As for the phase prior to the starting of an Art. 60 procedure, in particular regarding determination of the LSA and preliminary vetting of cases, reference 
should be made to WP244 rev.01 and to the other relevant guidance. 


The main phases in an OSS procedure are outlined below: 
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PHASE 0: decide who is LEAD 


This is related to the confirmation that cross-border processing takes place and the location of the main or of the single 
establishment of the controller/processor (Art. 56) 


PHASE |: exchange relevant information and investigate 


Art. 60 (1) 
Possibly Art. 60 (2): 


mutual assistance & joint operations 


PHASE Il: prepare decision 
Art. 60(3) to (5) 


PHASE Ill: adopt decision 
Art. 60 (6) to (10) 


Possibly Art. 60 (2): 
mutual assistance & joint operations 


EDPB 
Information 
System 


Art. 60(12) 
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ll. STEP BY STEP PROCEDURE 
Phase I: Exchange information & Investigate 





Legal Requirements 


Who, When and What 


Recommendations and best practices 


EDPB Information System 

















(IMI) 
Article 60(1) — Who: LSA and CSA equally - Utmost and determined effort by SAs 
to achieve consensus as a legal 
When: throughout the entire objective (39); 
cooperation procedure - Consensual acting should be the rule 
(41); 
- Use all possible tools to reach 
- Mandatory cooperation consensus (40,42); 
- Active cooperation (fair and - Select cooperation approaches best 
constructive) to prevent suited for the case at hand (43); 
disputes in an endeavour to - Provide each other the opportunity to 
reach consensus (42) express its views (42); 
- Take each other’s views into account 
(42, 127). 
Article 60(1) — (...) The Who: LSA and CSA equally - Exchange all information (facts and Art 60 Informal 
legal reasoning) necessary to reach a Consultation 








When: throughout the entire 
cooperation procedure, in a timely 
manner 





- Mandatory exchange of all 
relevant information on the 
subject matter 

- Exchange of necessary 
documents and views before 
the submission of the draft 
decision 





conclusion on the case (46); 

- Informal exchanges among SAs in 
earlier stages and raising of possible 
issues, before triggering formal steps, 
to increase the likelihood of reaching 
consensus (55-57); 

- Information exchanges should be 
adequate and proportionate to 
enable SAs to perform their role (47); 

- For the LSA: relevant information 
when dealing with the 
controller/processor (findings, 
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Legal Requirements Who, When and What Recommendations and best practices EDPB Information System 
(IMI) 





reports, exchanges with the 
organization) (48-50); 

- For the CSA: relevant information 
regarding the case (complaint, 
further correspondence, data breach 
notification, any further findings, 
etc.) (50); 

- Only share personal data if necessary 
to deal with the case (51); 

- Flag specific issues as confidential to 
meet national legal requirements 
(52). 














Article 60(2) — Who: LSA - Requests can cover: additional info | Art 61 Mutual Assistance 
from the complainant; facts to be | Art 61 Voluntary Mutual 


When: at any time prior to submission checked; evidence to be collected; Assistance 
of DD inspections to be carried out on the 


establishment of the controller/ 
processor (70-73). 





- Possibility to request mutual 
assistance to a CSA(s), including 
to investigate an ongoing cross 
border case. 

- Such requests follow the rules of 
Article 61 (grounds for the 
request; deadlines for the reply). 

- Reply by CSAs without undue 
delay and no later than 1 month 
after receiving the request. 
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Legal Requirements 


Who, When and What 


Recommendations and best practices 


EDPB Information System 














(IMI) 
Article 60(2) — Who: LSA - The joint operation can be hosted by Art 60 Informal 
the LSA or can be organized by the Consultation 
WHER: at any time prior to submission LSA and deployed in one or several Art 62 Joint Operation 








of the DD 


What: 

- Possibility to set up a joint 
operation to investigate a 
controller or processor 
established in another Member 
State 

- Rules of Article 62 are 
applicable to such joint 
operation 





Member States where there are 
establishments of the controller/ 
processor relevant for the specific 
case (79-80). 


NOTE: Article 60(2) may also be 
relied on after conclusion of the OSS 
procedure to perform checks under 
60(10) (see below) (74, 80). 
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Phase Il: Prepare decision 





Legal Requirements 








la 








Article 60(3) — 






to the other supervisory 
authorities. 








Who, When and what Recommendations and best practices IMI 
Who: LSA - Information to be provided to the Art 60 Informal 
CSAs swiftly, according to the Consultation 


When: without delay 





- Communicate to the CSAs the 
relevant information on the 
case at hand 





circumstances of the specific case 
(87-88); 

The LSA should consider to 
proactively and quickly share a 
timetable with the steps to be taken 
until the submission of the draft 
decision (89-90, 102); 

After completion of investigation, 
the LSA should send a summary of 
the results to the CSAs for their 
feedback within a short reasonable 
deadline. The LSA shares its 
assessment on the feedback 
received (94); 

‘Relevant information’ includes any 
additional exchanges on 
controversial issues or divergent 
views in line with the consensus 
objective (93-95); 

The LSA can share with the other 
CSAs the scope and main conclusions 
of the DD prior to its formal 
submission, in order for the CSAs to 
contribute to the overall procedure 
(57, 93); 

In the preparation of the DD, the LSA 
should take into account the views 
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Legal Requirements 


Who, When and what 


Recommendations and best practices 


IMI 











1b 


preliminarily expressed by the CSAs 
(93-94); 

-  Insimple cases, where the DD is self- 
explanatory and/or very little 
information needs to be exchanged, 
the relevant information may only 
be shared along with the DD (104). 


NOTE: See Phase 1, step 1b 





Article 60(3) — It shall 
delay to 


the other supervisory 
authorities concerned for their 
opinion (...) 








Who: LSA 


When: as soon as possible, after 
gathering all facts and exchanging 
information and points of view with the 
CSAs, which depends on the complexity 
and particularities of cases. 


- Mandatory submission of a 
draft decision to the CSAs in all 
Article 60 cases for 
consultation purposes. 








EXCEPTIONAL CASE: If there are 
supervening factors, including 
comments submitted by the CSAs or 





- The submission of a DD applies to 
all OSS procedures, including in 
situations where: the complaint is 
withdrawn during an ongoing A60 
procedure; there is an amicable 
settlement; the infringement 
ceased; the case is to be closed; no 
action against the controller or 
processor is envisaged; or where 
the LSA is not issuing the final 
decision (97-100); 

- The DD should correspond in form 
and content to the decision to be 
adopted in the specific case, and 
contain all formal requirements of a 
legally binding measure (109-110, 
114-117); 

- The DD should have a written form, 
clear and unambiguous wording, 





Art 60 Draft Decision 
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Legal Requirements 


Who, When and what 


Recommendations and best practices 


IMI 





further submissions from the 
controller/processor, the LSA may 
withdraw its draft decision within the 
4-week period consultation envisaged 
under 60(4), clearly stating its reasons, 
and submit a new DD to the CSA(s), as 
swiftly as possible, and a new deadline 
starts running (163). 





issuing SA, date of issue, signature 
of authorized SA staff, reference to 
the right to an effective remedy 
(109); 

- The draft decision should also 
contain a description of relevant 
facts, sound reasoning and a proper 
legal assessment, so CSAs fully 
understand its conclusions (104, 
111,113); 

- The DD should set out clearly 
whether an issuing under Art 60(7), 
(8) or (9) is pursued. In case of Art 
60(9) it should be clear what will be 
issued by the LSA and what by the 
complaint receiving SA(s) (227); 

- The four-week period starts running 
upon submission of the DD 
(103,135); 

- The LSA should ensure that only 
triggers the workflow in working 
days and that the deadline does not 
expire on an EU holiday (138). 

- The LSA should make sure the DD is 
fully compliant with the national 
rules for the right to be heard 
(RTBH), and that the steps taken in 
that regard are referenced in the 
DD (105). 








1c 





Article 60(3) — ae shall] 














- The LSA should react to the views 
provided by all CSAs (129); 
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Legal Requirements 


Who, When and what 


Recommendations and best practices 


IMI 





When: as swiftly as possible 


- Consider the views of CSAs 
regarding the draft decision, in 
order to reach a consensual 
outcome. 


- The LSA should explain how it 
intends to take due account of such 
views, which are to be followed and 
those which are not, including for 
being contradictory among each 
other (129); 

- The LSA should take the utmost 
account of the views of the 
complaint receiving CSA, since it 
acts as a point of contact for the 
complainant and this CSA may be 
required to adopt and defend a 
decision (130). 


NOTE: See Phase I, step 1a, on reaching 
consensus and Phase II, step 1a, on the 
preparation of the draft decision 








2a 






(...) 





Article 60(4) — 


to the draft decision, 





Who: CSA(s) recognized as participating 
in the OSS procedure 


When: Within 4-week period following 
submission of DD by LSA 


What: Option to submit a RRO on the 
DD. 


NOTE: See EDPB Guidelines 9/2020 on 
concept of RRO 





- Reaching consensus should take 
priority over initiating the dispute 
resolution process, so previous 
steps should be carefully followed 
(133); 

- The CSA should provide its 
objection(s) in one single 
submission, though distinguishing 
the different objections (139); 

- If the CSA wishes to modify its 
submission, it can still do so during 
the 4-week period by deleting the 
previous version and uploading in 
IMI a new one (139); 





Art 60 Draft Decision 
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Legal Requirements 


Who, When and what 


Recommendations and best practices 


IMI 





An endorsement or referral to 
another CSA’s objection does not 
constitute a RRO. Each CSA should 
then submit its own objection 
complying with the RRO guidelines 
(142-145). 














2b 





(...) the LSA shall, if it does not 


follow the RRO or is the opinion 
that the objection is not 
relevant or reasoned, 








Who: LSA 


When: as soon as possible, after the 4- 
week period of consultation on the DD 


What: 

- Mandatory submission of 
matter of the case to EDPB 
under Article 65(1)(a) if LSA 
does not follow RRO/does not 
find objection to be a RRO 


NOTE: See EDPB Guidelines 9/2020 on 
concept of RRO 





Reaching consensus should take 
priority over initiating the dispute 
resolution process, so previous 
steps should be carefully followed 
(133,149); 

In response to RRO, the LSA should 
convey its first assessment and 
present which RRO intends to 
follow and in what extent, and 
which does not, and better clarify 
its position while giving the CSA(s) 
the opportunity to further explain 
the objections (146-149); 

Such additional cooperation can 
take different forms, including 
organization of meetings or use of 
informal consultation procedures 
(146, 159); 

Following the LSA’s explanations 
and if the conflicting views are only 
marginal, the CSA(s) may consider 
withdrawing the RRO. In such 
situation, the CSA should explicitly 
declare that it withdraws its RRO 
(147-149); 





Art 65 - Dispute Resolution 
by the Board 
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Legal Requirements 


Who, When and what 


Recommendations and best practices 


IMI 

















- The LSA should document this 
withdrawal and notify the other 
CSA(s) without delay (148); 

- When consensus is not achieved, 
the LSA should refer the matter to 
the EDPB as soon as possible 151- 
153, 174, 181). 


NOTE: If the LSA wishes to follow some 
objections, but does not wish to follow 
other objections and/or does not consider 
them to be relevant and/or reasoned, the 
LSA should submit a revised draft in the 
procedure as per Article 60(5), according to 
the following section. >The LSA should 
indicate clearly, through an informal 
exchange, which of the objections it intends 
to follow within the revised draft decision 
and how it intends to do so. Further, the 
LSA should indicate clearly, which 
objections have been noted as being the 
subject of a possible later dispute resolution 
via Article 65(1)(a) (154). 
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3a 





Article 60(5) — Where the LSA 
intends to follow the RRO, it 


shall 








Who: LSA 


When: as soon as possible (good 
administration principle) 


What Mandatory submission of a 
revised draft decision to the 
CSA(s), only in case the LSA 
intends to follow a RRO. 


NOTE: See Phase II, step 1b, on 
submission of the draft decision 





The LSA is barred from submitting a 
revised draft decision solely on 
account of comments or other 
remarks (162-163 and EDPB 
Guidelines 9/2020); 

Following the assessment of the 
RRO, the LSA should clearly state to 
all CSA(s) its intention to submit a 
revised draft decision (RDD) (169- 
170); 

The lapse of time between the RRO 
and the submission of a RDD should 
be as small as possible and 
appropriate to the OSS procedure 
(167-168); 

Prior to the formal submission, the 
LSA may share a preliminary RDD, 
via informal consultation, to ensure 
that there is agreement on the 
amendments introduced and 
consensus can be achieved (170); 
The RDD should completely address 
the risks posed by the initial DD 
regarding the data subjects’ 
fundamental rights and freedoms, 
as identified in the RRO (158). 





Art 60 Revised Draft 
Decision 
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Legal Requirements Who, When and what Recommendations and best practices IMI 
3b Article 60(5) — (...) Who: LSA and CSA(s) recognized as - The RDD should be regarded as a Art 60 Revised Draft 
participating in the OSS procedure different legal instrument compared Decision 











WER: See Step 2a/2b in Phase II 


What: See Step 2a/2b in Phase II 


NOTE: In case no RROs are raised, 
article 60(6) applies 


to the DD submitted under 60(4) 
(183); 

- ACSA may raise a RRO to the RDD 
even if it had not raised an 
objection to the DD (183-184); 

- ACSA should not raise a RRO in 
relation to a RDD if there was no 
RRO directed at that specific issue 
and the LSA has not revised the 
draft decision in respect of such 
issue (186). 


NOTE: See Phase II, Step 2a/2b on the 
submission of RRO 








EXCEPTIONAL CASE: If there are 
extraordinary circumstances, not met 
before, where the LSA mindfully intends to 
follow a RRO raised during this last 
consultation period that allows reaching 
consensus and avoiding to refer the matter 
to the EDPB when there is no longer a 
dispute to be settled, the LSA may submit a 
(re) revised draft decision (176-180). 
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Phase Ill: Adoption of final decision 
































Legal Requirements Who, When and What Recommendations and best practices IMI 
1 Who: The CSA(s) recognized as - Noneed to act, agreement is implied 
Article 60(6) - Where participating in the OSS procedure by absence of RROs (tacit 
agreement) (188) 
When: After 4 weeks from submission of - National final decision by LSA/CSA 
to the draft DD (60.4); or after 2 weeks from [see 2a/2b] should not depart from 
decision submitted by the submission of (last) RDD (60.5) binding DD/RDD (189-191) 
lead supervisory authority - Binding effect limited to specific, 
What: concrete case addressed (196) 
- Agreement between LSA and - ACSA intending to join the 
CSA on DD/RDD, in the absence procedure at this stage should 
of RROs consider initiating a separate OSS 
- Bindingness of DD/RDD on LSA procedure (otherwise, it will be 
and CSAs > DD/RDD may no automatically bound by DD/RDD). 
longer be withdrawn or (192-195) 
amended, subject to exceptional - Text/Conclusions of binding DD/RDD 
circumstances. (187; 191) may be re-used for subsequent OSS 
procedure (same or different 
controller, same infringement) if this 
can speed up handling of case. (197- 
198) 
2a | Article 60(7) — (I) Who: The LSA - Provide full copy of final national Art 60 Final Decision 











the main establishment or 


single establishment of the 

as the 
case may be and the 
other supervisory authorities 





When: As swiftly as possible from 
bindingness under 60(6) (good 
administration principle) (206) / NOTE: 
within 1 month from EDPB binding 
decision under 65(1)(a) (206) 





decision (as per national law) to 
controller/processor (210) 
- Inform controller/processor also on 
their obligations under 60(10) (214) 
- Use IMI “Final Decision” fields to 
inform other CSAs and EDPB of 
national final decision (211-212) 
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Legal Requirements Who, When and What Recommendations and best practices IMI 
concerned and the Board of the - Use IMI “Final Decision” fields to 
in question, including a | EXCEPTIONAL CASE: Supervening provide summary of facts and 
constraints during this period (e.g. aos other Cons. Jnd EDRB 
relevant EU case law/legislation) may s Acopa national final decision in 
require LSA to refrain from adopting English is also recommended to be 
national final decision and to submit provided to CSAs, via IMI (217) 
new DD to CSAs, after informing CSAs 
(207) 
What: 
- Adoption of the national final 
decision (203-205; 230-235) 
- Notification of national final 
decision to establishment of 
controller/processor (pursuant 
to national law) (208-209) 
- Information to other CSAs and 
Board about national final 
decision 
- Summary of facts and grounds in 
decision 
2b | Article 60(7) — (II) The Who: The CSA which received a - Information should be provided to Art 60 Final Decision 











complaint addressed in the binding 
decision under 60(6) or 65(1)a, in which 
action is taken by the LSA on the 
complaint 





complainant in line with national law 
and practices (213) 

- Complainant should be informed 
that right of redress (if any) is to be 
exercised in the LSA’s MS (national 
law) (213) 
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Legal Requirements 


Who, When and What 


Recommendations and best practices 


IMI 





When: As swiftly as possible (good 
administration principle) following 


information by LSA on adoption of 
national final decision 


What: Information to complainant on 
national final decision adopted by LSA 











Article 60(8) - By derogation 
from paragraph 7, where a 
complaint is dismissed or 
rejected, 






and shall 
thereof 





Who: The CSA which received a 
complaint addressed in the binding 
decision under 60(6) or 65(1)a, if the 
complaint is dismissed or rejected (218- 
219; 236-238) 


When: As swiftly as possible (good 
administration principle) following 


bindingness under 
60(6) / within one month following 
bindingness under 65(1)a 


What: 

- Adoption of national final 
decision dismissing/rejecting 
complaint (national law) (221- 
225; 228-229) 

- Notification of national final 
decision to complainant 
(national law) (219; 226) 





- The CSA may rely on LSA to convey 
information on national final 
decision to controller/processor 
(239) 

- Use IMI “Final Decision” fields to 
inform other CSAs and EDPB of 
national final decision (240) 

- Use IMI “Final Decision” fields to 
provide summary of facts and 
grounds to other CSAs and EDPB 
(240) 

- Controller/processor should be 
informed that right of redress (if any) 
is to be exercised in the CSA’s MS 
(national law) (239) 

- A copy of national final decision in 
English may be also provided to 
CSAs, via IMI (240) 





Art 60 Final Decision 
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Legal Requirements Who, When and What Recommendations and best practices IMI 





- Information to controller on 
national final decision (national 
law) (220) 

- Information to other CSAs and 
Board about national final 
decision 

- Summary of facts and grounds in 
decision 














Article 60(9) — (I) Who: LSA and CSA bound by agreement 
(under 60(6) ) / bound by decision 
(under 65(1)a) to partly dismiss/reject 
and partly act on a complaint (241-242) 


When: As swiftly as possible (good 
administration principle) following 





bindingness under 
60(6) / within one month following 
bindingness under 65(1)a 


What: 

- Adoption of separate national 
final decisions by LSA and CSA 
regarding different outcomes in 
respect of the same complaint 
(242) 
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Legal Requirements Who, When and What Recommendations and best practices IMI 
4b | Article 60(9) — (Ii) Who: The LSA taking action on part ofa_ | See Step 2a for LSA Art 60 Final Decision 
complaint in relation to the controller 
NOTE: The LSA may rely on CSA to convey 
WER / What: See Step 2a for LSA information on national final decision to 
complainant (243) 
NOTE: The LSA must inform complainant 
of the national final decision it has 
territory of its Member State PAE eR 
and 
thereof 
Ac | Article 60(9) — (III)[...] Who: The CSA dismissing or rejecting See Step 3 for CSA Art 60 Final Decision 











and shall 
and shall 








5a 





part of a complaint 


When / What: See Step 3 for CSA 








Article 60(10) — (I) 






pursuant to paragraphs 7 and 


processing activities in the 
context of all its establishments 
in the Union. 





Who: Controller/processor 


When: After notification by LSA of 
national final decision under 60(7) or 
60(9) (244-245) 


What: Taking and notification of 
measures to ensure compliance with 
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Legal Requirements 


Who, When and What 


Recommendations and best practices 


IMI 





5b 





Article 60(10) — (Ila) 





LSA’s national final decision (243; 246- 
248) 











5c 











Article 60(10) — (IIb) 
which 





Who: The LSA 


When: As soon as possible following 
notification by controller/processor 
(249) 


What: Information to CSAs on measures 
taken by controller/processor 





- LSA should consider providing CSAs 
with assessment of measures taken 
by controller/processor (249) 

- LSA may request mutual assistance 
from CSAs under 60(2) to verify 
compliance by controller/processor 
in relevant establishments (62; 69; 
74; 80) 
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ARTICLE 60(11) - URGENCY PROCEDURE 














Requirements Who, When and What Recommendations and best practices IMI 
Article 11 - Where, in Who: CSAs and LSA -  SAs should consider various Art 66 Adopted Provisional 
exceptional circumstances, factors, in particular the stage Measures 
When: At any time in the course of reached in OSS procedure, prior Art 66 Urgent Opinion/Decision by 





has reasons to an OSS procedure, if exceptional to invoking urgent need to act the EDPB 
consider that there is an circumstances apply (252-259) 
urgent need to act in order - CSAs and LSAs should jointly 





to protect the interests of What: Application of urgency consider how best to factor the 







data subjects, procedure under Article 66 outcome of the Article 66 
procedure into the ongoing OSS 
NOTE: EDPB binding decision in procedure (260-265) 


urgency procedure under 66(3) 
may entail adoption of national 
final decision without DD/RDD 

(265) 














Adopted 





